HeaderVault per HeaderVault

HeaderVault lets you modify headers in Firefox: add, change and remove HTTP headers of requests and responses. It is built for web developers, QA and DevOps engineers who send auth tokens, feature flags or debug headers while they test.

Everything works locally. HeaderVault makes no network requests, has no analytics or telemetry, and keeps your headers in local extension storage. The code ships unminified.

Modify headers
- Set, Remove or Append request and response headers
- Turn each header row on or off with one click
- Several rows for the same header: the lowest row wins, Set + Append are combined for you
- Invalid rows are marked next to the field and never break the others

Profiles and URL filters
- Separate header sets for staging, production or local development, switched with one click
- Pause everything with one switch
- Limit a profile to URL patterns (||api.example.com^) or RE2 regular expressions, exclude URLs, choose resource types

Import and export
- Export profiles to a JSON file and import them on another computer
- Imports profiles exported from ModHeader (JSON); every skipped setting is listed before you confirm

Privacy
- Permissions: declarativeNetRequestWithHostAccess and storage; site access is optional and asked for when you enable your first header
- No account, no sync, no tracking

In Firefox, header rows that would change page security response headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, CORS headers and similar) are kept but not applied, as required by add-on policy.

Header values are fixed text: the browser's declarativeNetRequest engine does not run scripts or per-request values.

Not affiliated with or endorsed by ModHeader.