How to Set Up Charles Proxy on Android

What Is Charles Proxy & Why Use It on Android?

Charles Proxy is a cross-platform HTTP and HTTPS debugging proxy server that sits between client applications and the internet. For mobile engineers, security researchers, and QA specialists, Charles acts as a local man-in-the-middle (MITM) engine. It logs every outbound request initiated by your Android smartphone or emulator, measures endpoint latency, rewrites headers, throttles bandwidth to simulate degraded cellular connectivity, and decrypts TLS payloads in clear, formatted JSON or XML.

While inspecting web browser traffic on desktop machines is straightforward via native DevTools, modern Android mobile applications encrypt their network streams using TLS 1.3 and certificate verification routines. Configuring Charles Proxy for Android allows you to peer inside third-party mobile applications, audit API authentication headers, debug failing mobile payments, verify analytics tracking tags, and diagnose rate-limiting responses before deploying client updates.

Prerequisites & Finding Your Workstation IP

Before configuring your Android device, you must ensure both your computer (running Charles Proxy) and your Android handset or tablet are connected to the exact same local Wi-Fi network. Public coffee shop networks, enterprise guest Wi-Fi, and networks with AP Client Isolation enabled will prevent your phone from reaching port 8888 on your computer.

By default, Charles Proxy listens on HTTP proxy port 8888 across all local interfaces:

Follow these steps to find your computer's local IPv4 address:

# macOS / Linux terminal:
ip route get 1.1.1.1 | awk '{print $7}'

# Windows PowerShell:
(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias 'Wi-Fi*').IPAddress

Step 1: Android Wi-Fi Manual Proxy Configuration

With your workstation IP confirmed and Charles Proxy running, configure your Android device's Wi-Fi network adapter to route all outbound TCP traffic through your computer's proxy port.

Tap Save. At this moment, all HTTP requests initiated by your Android phone are routed toward your computer on port 8888.

Step 2: Authorizing the Android Connection in Charles

The very moment your phone sends its first network packet through the proxy, Charles Proxy detects a connection from an unfamiliar IP address on your local subnet. For security reasons, Charles blocks access until you explicitly authorize the device.

A modal dialog will pop up on your computer screen asking: "A connection attempt from [phone IP] was received. Do you want to allow it?"

Click Allow. Charles will automatically add your phone's IP address to its Access Control whitelist.

If you accidentally click Deny, or if the prompt never appears, you can configure the Access Control whitelist manually via Proxy > Access Control Settings:

Step 3: Downloading the Charles SSL Certificate

At this stage, plain HTTP traffic is captured, but all HTTPS traffic appears in Charles as encrypted CONNECT tunnels with padlock icons and garbled payloads. To decrypt TLS streams, Android must trust the Charles Root Certificate Authority (CA).

Charles includes built-in instructions and serves its root certificate on demand through a local web gateway:

Step 4: Installing the CA Certificate on Android

Once downloaded, you must install the certificate into Android's credential store.

Certificate Installation across Android Versions

Step 5: Enabling SSL Proxying for HTTPS Decryption

Installing the certificate on your phone equips it to validate Charles-generated SSL certificates. However, Charles itself will not attempt to decrypt HTTPS traffic until you configure SSL Proxying rules.

Step 6: Android 7+ Network Security Config & SSL Pinning

If you open Google Chrome on Android now, you will notice all HTTPS websites decrypt successfully. However, when you launch your native mobile application, requests may fail with SSLHandshakeException: Trust anchor for certification path not found.

Starting in Android 7.0 (API Level 24), Google altered the default trust policy: native applications no longer trust user-installed CA certificates unless the app developer explicitly permits them in the application manifest.

Solution A: For Developers (Apps You Are Building)

If you have access to the app source code, create a network security configuration file to instruct debug builds to trust user certificates.

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <debug-overrides>
        <trust-anchors>
            <!-- Trust system CAs and user-installed CAs (Charles) in debug builds -->
            <certificates src="system" />
            <certificates src="user" />
        </trust-anchors>
    </debug-overrides>
</network-security-config>

Then reference this configuration in your AndroidManifest.xml file under the <application> tag:

<application
    android:name=".MainApplication"
    android:icon="@mipmap/ic_launcher"
    android:label="@string/app_name"
    android:networkSecurityConfig="@xml/network_security_config">
    ...
</application>

Solution B: For Third-Party Applications (Security Audits & Reverse Engineering)

When analyzing third-party production APKs where you cannot edit source code, use one of three established bypass mechanisms:

Step 7: Chaining Charles with PXM2 4G/5G Mobile Proxies

While Charles inspects and decrypts packets locally, the requests leaving your workstation carry your home or office broadband IP. When auditing anti-fraud defenses, Instagram/TikTok mobile automation, or geo-restricted streaming APIs, targets will flag datacenter or residential broadband IP patterns from mobile user-agents.

You can chain Charles Proxy upstream through PXM2 dedicated 4G/5G mobile modems. In this architecture, Charles decrypts and displays requests locally on your desktop screen, while PXM2 dispatches the actual requests to the target over authentic mobile carrier radio networks.

To configure upstream chaining in Charles:

Step 8: Disabling the Proxy & Troubleshooting Common Errors

When your testing session concludes, remember to turn off the proxy on your phone. If you close Charles on your workstation while the Android Wi-Fi proxy is still enabled, your phone will lose all internet connectivity.

To revert: Return to Settings > Network & internet > Wi-Fi > Edit Network > Advanced options, and change Proxy from Manual back to None.

Troubleshooting Matrix: Android Charles Proxy Issues

常见问题解答

相关移动代理指南

浏览 PXM2 网络中关于编程语言、操作系统和自动化平台的安装教程。

平台与操作系统指南

开发人员与自动化指南