Last updated: 2026-08-14
PostTaco is a browser-based HTTP request playground at
posttaco.dev. The PostTaco browser
extension is an optional companion that lets the site run requests a
browser otherwise can't — those blocked by CORS, those needing headers
the page can't set, and intranet or plain-http:// targets.
Nothing. The extension collects no personal data. It has no analytics, no telemetry, and no tracking. It stores no browsing history and sets no cookies. It sends no data to PostTaco or to any third party.
When you use posttaco.dev, the page asks the extension to run a request you authored. The extension executes that request on your own device and returns the response to the page. Requests and responses travel only between the page and the target server you chose — never through a PostTaco server. Only pages on the posttaco.dev origin can talk to the extension; the browser enforces this.
Access to all websites (host permission): required to send the HTTP requests you author to whatever host you target, and to read the responses. The extension acts only on requests initiated by pages on posttaco.dev.
declarativeNetRequest: used to set request headers the
browser blocks pages from setting (such as User-Agent or
Referer), and only for the specific request you run.
Questions: [email protected].