How do I verify HTTPS connections in Mobile apps?

Unfortunately, unless you sniff and inspect your own traffic, you can not... My advice is not to use built-in browsers that do not indicate the protocol being used to handle sensitive information


As @StefHeylen says, you can't, generally. And as @d1str0 says, Burp is one way to see if the traffic is encrypted, if you can proxy the app through it.

It's actually worse than that though - mobile apps don't always only make a single connection to a server. It's not uncommon for them to use HTTP for some parts, and HTTPS for others. They can also do some other tricks which normal browsers don't generally touch. For example, they can certificate pin and refuse to run if they can't make a secure connection to a specific server.

Therefore, it's perfectly possible to have mobile applications that refuse to run when proxied (because they connect to a specific HTTPS server with a specific certificate, which means Burp fails), but which then send payment data through unencrypted means to a different server. The only way to observe this is through packet inspection using something like Wireshark - you'll see a bunch of encrypted data, then some unencrypted data (often JSON or XML) being sent to a different server.

It's also possible for payment data to be sent correctly, then for third party scripts for statistics monitoring (seeing how far users get through forms within the app, for example) to send the same details over unencrypted channels because the app developer hasn't excluded payment fields.

The whole mobile application system is a mess - I'd second Stef's advice to avoid making payments using apps if possible. If you can't, consider using a specific card for those payments, which you monitor regularly for unusual transactions.


Using a proxy tool like BurpSuite will allow you to test whether or not that specific app is allowing or disallowing bad HTTPS connections.