Free for Windows, macOS & Linux · v1.0.0

HookCatch See every webhook. Replay any of them.

HookCatch catches the webhooks Stripe, GitHub, Shopify and your own services send, right on your machine and exactly as they arrived. Check the signature, forward them to your app, and when your code breaks, fix it and send the same request again.

Download free See how it works
  • Works with any language or framework
  • Public URL in one click
  • No account needed
  • API & CLI for your tests
HookCatch showing a captured Stripe payment webhook as a JSON tree, with its signature checked and valid
Setup time
< 1 minute
Providers checked
8
Price
$0
Accounts needed
0

Webhooks are the part of your app you can't see

Every team has lost an afternoon to one of these.

A webhook arrives once, from someone else's server, while you're not looking. HookCatch keeps every one of them, shows you exactly what was sent, and lets you send it again whenever you need to.

The webhook you never saw

Stripe says it sent it. Your logs say nothing arrived. Without the raw request you are guessing which one is wrong.

01

"No signatures found matching the expected signature"

A proxy re-encoded the body, the secret is from the wrong mode, or the timestamp is too old. The error message never says which.

02

Waiting for the provider to try again

Your handler crashed on the first delivery. Now you wait an hour for the retry, or click through a dashboard to resend it.

03

The retry logic nobody tested

Your own service sends webhooks too. What happens when the receiver answers 503 twice, or hangs? Production finds out first.

04

Set up in under a minute

Change one URL. See everything.

  1. 1
    Install HookCatch and open it

    It starts listening straight away at http://127.0.0.1:8040. No account, no sign-up.

  2. 2
    Point the sender at it

    Use a path per service, like /stripe or /github. For Stripe, GitHub and other providers on the internet, switch on the public URL.

  3. 3
    Watch requests arrive

    Every request appears the moment it lands: headers, body, timing and the answer HookCatch gave.

Signatures checked for

  • Stripe
  • GitHub
  • Shopify
  • Slack
  • Twilio
  • Paddle
  • Standard Webhooks
  • Any HMAC
terminal
# Anything that sends HTTP can send it to HookCatch
$ curl -X POST http://127.0.0.1:8040/orders \
    -H "Content-Type: application/json" \
    -d '{"order": {"id": 1042, "status": "paid"}}'

# Stripe CLI, straight into the /stripe endpoint
$ stripe listen --forward-to 127.0.0.1:8040/stripe

# Or switch on the public URL and paste it into
# the provider's dashboard:
# https://quiet-river-1042.trycloudflare.com/stripe

Built for the requests that matter

Everything a webhook needs, in one window.

Check it, forward it, replay it, change it, and reach it from anywhere.

Signature checks

Know why the signature failed, not just that it did.

Add the signing secret once and HookCatch checks every request the way the provider's own library does. When it fails, it tells you the reason in plain words and how to fix it.

  • Stripe, GitHub, Shopify, Slack, Twilio, Paddle, Standard Webhooks (Svix and others) and any HMAC scheme you describe
  • Tells a missing signature from one that doesn't match, and a right signature that is simply too old, with the signature it expected
  • The event type and delivery id picked out of every request, so redeliveries are linked to the original
  • Compare any two requests, or an event with the last one of the same type, to see which fields changed
HookCatch in dark mode explaining that a Stripe signature has expired, with a button to replay it with a fresh signature

Forward to your app

Catch it, then pass it on.

Give an endpoint a target and every request is sent on to your app as it arrives, byte for byte. You see what came in and what your app answered, side by side.

  • Forward to localhost, a container or any URL, with the path carried over or rewritten
  • Your app's answer recorded with its status, headers, body and timing
  • Answer the provider straight away, or wait and pass your app's answer back
  • A waterfall for every send: DNS, connect, TLS, waiting and download
The Sends tab: a Stripe webhook forwarded to localhost:8000, with the app's 200 answer and its JSON body

Replay and edit

Fix the bug. Send the same webhook again.

No more waiting for the provider to retry or hunting for a resend button. Replay any captured request in one keystroke, or change it first and send your version.

  • Replay to the forward target, or to any URL you choose
  • Edit the method, URL, headers or body in a JSON editor before sending
  • Edited bodies re-signed with the endpoint's secret, so your app still accepts them
  • Every attempt kept, with your app's answer, so you can see what changed
  • Copy any request as cURL, fetch or Python
The edit and send composer with a changed Stripe event body, the re-sign option switched on and the app's answer below

Public URL

A public HTTPS address in one click.

Stripe, GitHub and Shopify cannot reach your laptop. Switch on the public URL and HookCatch gives you an https address that leads straight to it, ready to paste into the provider's dashboard.

  • Runs on Cloudflare's free quick tunnels: no account, no sign-up, no configuration
  • Only the capture port is shared. The testing API never is
  • Requests that came through the public URL are marked, so you know where each one came from
  • Ready-to-copy snippets on every empty endpoint: curl, the Stripe CLI and your tests
HookCatch in dark mode with a public trycloudflare.com URL switched on, waiting for the first request to /stripe

Built for automated tests

Your end-to-end tests can check the webhook too.

Place the order, wait for the webhook your app sends, check what's in it. A few lines, in the language you already test with, and no flaky sleep(5).

  • HTTP API: List, filter and fetch requests, read raw and decoded bodies, replay and clear.
  • /wait: Waits for the webhook your app sends, filtered by path, header or JSON field. No sleep(5).
  • Live events: Every new request pushed over WebSocket the moment it lands.
  • Headless server: hookcatch serve for CI pipelines and shared machines, with the public URL if you want it.
  • JavaScript
  • TypeScript
  • Python
  • PHP
  • Go
checkout.spec.js
const hooks = new HookCatch();
await hooks.clear("orders");
await page.click("text=Pay now");
const hook = await hooks.waitFor({
  endpoint: "orders",
  json: { "order.status": "paid" },
  timeout: 30,
});
terminal
$ hookcatch serve --tunnel  # headless, for CI
$ hookcatch wait -e orders --field order.status=paid
$ hookcatch tail
$ hookcatch replay 42 --to http://localhost:8000

Chaos mode · Misbehave on purpose

Your service sends webhooks too. Does it cope when the other side doesn't?

Turn chaos mode on for one endpoint and HookCatch becomes a bad receiver: it fails the first tries of each delivery, fails at random, answers with an error, never answers or drops the connection. Then watch whether your app backs off, retries and gives up the way it should.

  • Fail the first tries
  • Random failures
  • 4xx & 5xx
  • No answer
  • Dropped connection
  • Latency
The chaos settings for the /shopify endpoint: fail the first 2 tries of each delivery with a 503

Everything else you'd expect

Done properly.

  1. 01

    A path per service

    Requests to /stripe, /github or /orders land in their own endpoint, created on first use, with names and colours.

  2. 02

    Exactly as it arrived

    HookCatch has its own HTTP server, so you see the raw bytes, header order and casing, chunked bodies and all.

  3. 03

    Bodies you can read

    JSON as a tree, forms and multipart as tables, XML pretty-printed, and gzip, Brotli and deflate decoded for you.

  4. 04

    Answer how you like

    Choose the status, headers, body and delay each endpoint answers with, with placeholders that echo the request.

  5. 05

    Instant search

    Full-text search across paths, headers and bodies, and a list that stays fast with thousands of requests.

  6. 06

    Lives in your tray

    Keeps catching with the window closed, starts at login, and sends one tidy notification for a burst.

  7. 07

    Pairs with MailCatch

    If your app sends an email when a webhook arrives, HookCatch shows the emails MailCatch caught right next to the request.

  8. 08

    Light, dark & keyboard

    Light and dark themes that follow your system, and shortcuts for everything you do often.

Private by design

Your payloads stay on your computer.

  • Runs entirely on your machineNo account, no cloud inbox. Payloads with real customer data and tokens are stored only on your computer.
  • Local by defaultHookCatch listens only on your own computer. Other devices, and the public URL, only when you switch them on.
  • Secrets stay localSigning secrets are kept in your local data folder and never included in exports.
  • Sends only where you point itForwarding and replay go to the addresses you choose. The testing API rejects requests from websites.

Works with your stack

If it can receive an HTTP request, it works with HookCatch.

On Windows, macOS and Linux. No plugin, no SDK, no code change.

  • Laravel
  • Symfony
  • Rails
  • Django
  • FastAPI
  • Express
  • NestJS
  • Next.js
  • Spring Boot
  • ASP.NET
  • Go
  • Phoenix
  • …and everything else

HookCatch vs an online request bin

More than a place to paste a URL.

CapabilityAn online request binHookCatch
Where requests are stored On someone else's servers On your computer
Seeing the request Headers and body, often reformatted The raw bytes, headers and timing
Sending it to your app Copy, paste into curl, fix the headers Forwarded automatically, answer recorded
Trying again after a fix Wait for the provider to retry Replay in one keystroke
Signature failures Read the provider's docs and guess Checked, with the reason and the fix
Testing your own retries Write a fake failing server Chaos mode, per endpoint
Automated tests Poll a web page HTTP API, /wait, client libraries, CLI
Price Free tiers with limits and expiry Free

Get HookCatch 1.0.0 · Free

Catching webhooks in a minute.

Pick the file for your system. We'll email you a one-time code, and the download starts as soon as you enter it.

First launch, servers & CI

Windows

If Windows shows "Windows protected your PC", choose More info, then Run anyway. On Windows 10, the installer adds Microsoft's WebView2 if it's missing.

macOS

Drag HookCatch into Applications. The first time, open System Settings, then Privacy & Security, and click Open Anyway. (On macOS 14 and earlier, right-click the app and choose Open.)

Linux

Install the .deb with apt or the .rpm with dnf, like any other package. The AppImage needs no install: make it executable (chmod +x) and run it.

Command line

Unpack the archive and put hookcatch on your PATH. Run hookcatch serve on a server or in CI; it needs no window.

The first-launch warning appears because HookCatch is new and not yet widely downloaded; it only shows once. Updating: install the new version over the old one, and your endpoints, requests and settings are kept. Verify your download (optional): each file's SHA-256 checksum is in SHA256SUMS.txt.

Download HookCatch

Where should we send your code?

We'll email you a one-time code to start . No account, no spam.

FAQ

Questions, answered.

Something else? Ideas or partnership enquiries? Email jamal@unravelers.tech.

Is HookCatch really free?

Yes. Download it and use it for as many projects as you like.

Do I need to change my code?

No. Point the service that sends webhooks at HookCatch's address instead of your app's, and turn on forwarding so your app still gets every request.

How do Stripe or GitHub reach my laptop?

Switch on the public URL. HookCatch opens a Cloudflare quick tunnel and gives you an https address to paste into the provider's dashboard. It needs no Cloudflare account.

Is the public URL safe?

It leads only to the capture port, never to the testing API or anything else on your machine. Anyone with the address can send requests to it, so switch it off when you are done. Each one is a new random address.

Can I use it in CI?

Yes. Run hookcatch serve on the CI machine, then use the HTTP API, the client libraries or hookcatch wait in your tests.

Does it work with containers and other devices?

Yes. Choose to listen on all interfaces in Settings, and anything on your network or in Docker can reach HookCatch.

Where is my data stored?

In a folder on your computer, which you can open from Settings. Old requests can be cleaned up automatically.

Why does Windows or macOS show a warning the first time?

Both systems double-check apps that aren't yet widely downloaded. It only happens on the first launch; the steps are in the download section above.

Which systems are supported?

Windows 10 and 11 (64-bit), macOS 11 or later on Apple silicon and Intel, and 64-bit Linux (Ubuntu, Debian, Fedora, openSUSE and others).

Before the next delivery fails

See every webhook your app receives. Replay the ones that broke it.

HookCatch is free for Windows, macOS and Linux. Set up in under a minute, and stop waiting for the provider to try again.

Download HookCatch, free Talk to us