How to uninstall HTTP Toolkit on Mac

HTTP Toolkit does not install a system-wide certificate or change your Mac's proxy settings when you intercept a browser or terminal it launches. The settings it injects end with those sessions. What can outlive the app is setup you did yourself: a phone or emulator you pointed at it, a certificate you trusted by hand, or Android's adb server it started. Undo those first, then remove the app. This guide covers the disk image from httptoolkit.com and the Homebrew cask http-toolkit.

Undo interception outside this Mac first

HTTP Toolkit's intercept reference explains that a fresh browser window is an independent profile that "doesn't change the certificate or proxy settings on any other window", and that global Chrome interception disappears when Chrome is restarted outside HTTP Toolkit. The Existing Terminal option adds a snippet to shell startup files such as .bashrc, guarded by an HTTP_TOOLKIT_ACTIVE check and removed again when that terminal closes.

Devices are different, because you changed them yourself:

• Android. The Android guide installs the HTTP Toolkit app on the device, a user CA certificate and a VPN. Remove the certificate under Settings › Security › Encryption & Credentials › Trusted Credentials, User tab, remove the VPN in the device's settings, and uninstall the HTTP Toolkit Android app. A system certificate injected over ADB on a rooted device or emulator disappears on the next reboot. Menu names can differ between Android makers.
• iPhone or iPad. The iOS guide has you set a proxy in the Wi-Fi settings and install the "HTTP Toolkit CA" profile. Remove the proxy from the Wi-Fi network, and remove the profile under Settings › General › VPN & Device Management if you no longer want it.
• A certificate you trusted on this Mac. If you exported HTTP Toolkit's certificate and trusted it in Keychain Access for manual setup, delete "HTTP Toolkit CA" there. Remove the manually trusted root even if you also discard the app and its data.

Quit HTTP Toolkit and remove the app

1. Stop any interception and quit HTTP Toolkit from its app menu.
2. Search Activity Monitor for HTTP Toolkit and check that the app, its Helper processes and its node server have exited.
3. Move HTTP Toolkit from Finder's Applications folder to the Trash.
4. If you have Android platform tools installed, HTTP Toolkit may have started their adb server to look for devices. It belongs to the platform tools, not to HTTP Toolkit, and keeps running after the app is gone. Stop it with adb kill-server if you do not need it.

Removing the app does not cancel an HTTP Toolkit Pro subscription. Manage that from your account on the web.

Where HTTP Toolkit keeps its data

Open each path with Shift + Command + G in Finder and skip the ones that do not exist. The certificate location comes from HTTP Toolkit's open-source server, which stores ca.key and ca.pem in its configuration folder; the other paths were seen on the test Mac.

Check the result

Run these read-only commands after the app is in the Trash:

pgrep -ilf "HTTP Toolkit"
pgrep -il adb
security find-certificate -a -c "HTTP Toolkit CA"
grep -n HTTP_TOOLKIT ~/.zshrc ~/.bashrc ~/.bash_profile

• No output from the first pgrep means no command line matched the spaced name HTTP Toolkit; a separately named node server or crash reporter can still run. Inspect remaining processes in Activity Monitor and check their executable paths before treating them as HTTP Toolkit helpers.
• A line from pgrep -il adb means a process name matched adb, not necessarily that it is the Android server. Check its executable path and purpose in Activity Monitor; stop the verified Android server as described above only if you do not need it.
• A successful security find-certificate search reporting no matching item means no "HTTP Toolkit CA" was found in the default keychain search list used by this command, not in every keychain on the Mac. Permission or reading errors leave the result unknown. A printed certificate is a match; remove it in Keychain Access only if it is the one you trusted for HTTP Toolkit.
• If grep successfully reads the listed files and prints no matches, those files contain no line matching HTTP_TOOLKIT. "No such file or directory" means only that listed file is absent; permission or reading errors leave its contents unknown. Inspect matching lines to confirm an HTTP Toolkit snippet stayed behind, for example after a terminal was killed, then open that file in a text editor and delete only that block.

If you installed it with Homebrew

The http-toolkit cask's zap list includes ~/Library/Application Support/HTTP Toolkit, ~/Library/Caches/httptoolkit-server, ~/Library/Logs/HTTP Toolkit, ~/Library/Preferences/httptoolkit with your CA key, the preferences file and saved window state. Running brew uninstall --cask --zap http-toolkit yourself moves those to the Trash, whatever you selected in Mole. On the test Mac the app wrote its data to ~/Library/Application Support/httptoolkit and ~/Library/Logs/httptoolkit, spellings the zap list does not name, so check those folders afterwards. To remove only the app:

brew uninstall --cask http-toolkit

Mole adds --zap only when every path on the zap list sits inside ~/Library, none of them touches a row you left unchecked, and no other installed app claims them. Leaving ~/Library/Preferences/httptoolkit unchecked prevents zap. It can be selected manually or preselected by Remove data and settings with apps in General > Cleaning; Mole still checks the rest of the zap list. Back up the CA material before deleting it if you want to reuse it.

What Mole lists

For HTTP Toolkit from httptoolkit.com:

• ~/Library/Application Support/httptoolkit and ~/Library/Preferences/httptoolkit are listed unchecked when Remove data and settings with apps in General > Cleaning is off. Turning it on can preselect eligible data; uncheck these rows to keep the desktop configuration or CA material. The Chromium cache and Crashpad folders inside the first one are separate rows selected by default.
• ~/Library/Caches/httptoolkit-server, ~/Library/Logs/httptoolkit, the tech.httptoolkit.desktop preferences file, the recent-documents list and the temporary caches filed under the bundle ID are selected by default.
• Mole does not stop the adb server, remove certificates from your keychain or devices, or edit your shell startup files.

What this test covered

On September 21, 2026, HTTP Toolkit was copied from the official disk image into Applications, opened, and uninstalled with a Preview build of Mole 1.15 with everything ticked; there was no Homebrew receipt. The app, its data folder, server cache, logs and preferences went to the Trash, and a crash reporter process kept running after removal. On September 26, 2026, it was installed again from the same official download, opened once without intercepting anything, and removed with a development build of Mole with every row ticked. Mole's Status view showed it as one row of 12 processes, about 635 MB, including the Homebrew adb server it had started. All 16 items went to the Trash and nothing from the list was left; the adb server kept running afterwards. Device interception, a Pro subscription and the Homebrew cask were not tested.