Credentials stripped before anything is stored

See exactly what your webhook sent

Get a URL, point Stripe, GitHub, Shopify or your own staging environment at it, and read every header and byte that arrived — without pasting a production secret onto someone else's server.

See how it works

Free forever tier · No account · No card

Sample capture

POST /                             1.4 kB · 09:42:17

Content-Type:     application/json
Stripe-Signature: [redacted:stripe_signature_header]
User-Agent:       Stripe/1.0

{
  "type": "payment_intent.succeeded",
  "data": { "object": {
    "amount": 4999,
    "customer_email": [redacted:email],
    "metadata": { "order_id": "ORD-7741" }
  } }
}

Redacted before storage: stripe_signature_header ×1, email ×1

Every other webhook tester keeps your secrets

A real webhook carries a signing secret in a header, an API key in the payload and a customer's email address. Store the request verbatim and you now hold all of it, at a URL anyone who guesses the id can read. That is why a lot of companies forbid those tools, and use them anyway.

Redacted before it is written

Authorization and cookie headers, signature headers, private keys, AWS, GitHub, Slack, Stripe and OpenAI tokens, email addresses, and anything with the shape of a secret. It happens inside the request that received the payload, so the unredacted bytes never reach our disk at all.

Or encrypted to your browser

Redaction removes what we can recognise. For the rest, your browser makes a key and keeps it in the page's address — the part after the #, which browsers never send to a server. We can store your payloads and cannot read them.

Nothing missing, nothing guessed

Each capture says what was removed and how many times, so a blank field is never a mystery. Method, path, query, every header as it was sent, and the body pretty-printed when it is JSON.

Three steps, about ten seconds

Press the button

You get a URL like opengpt.in/hooks/k3f9x2qm. No form, no email, no account.
Point a sender at it

Paste it into Stripe, GitHub, Shopify, Twilio or your own code, in place of your endpoint.
Read what arrived

Headers, body and timing appear as the requests land. Secrets are already gone.

See plans

Start free. Pay when you need more.

Redaction and in-browser encryption are on every plan, the free one included. They are the reason to use this rather than the alternative, so they are not the thing we charge for. What you pay for is retention, volume and endpoints.

Free

1 endpoint
7 days of retention
100 requests
Redaction + encryption

Pro

$9 /mo

10 endpoints
30 days of retention
Unmetered requests
Redaction + encryption

Team

$39 /mo

100 endpoints
90 days of retention
Unmetered requests
Redaction + encryption

Full plan comparison →

Also on the house

Free tools, no signup, nothing uploaded

Format some JSON, decode a JWT, shrink a photo. Every one of these runs entirely in your browser — what you paste never leaves your device, and there is no account to create.

Browse all tools →

Images

Compress, resize and convert images without uploading them.

See all →

Developer

JSON, regex, encoding and the other small things.

See all →

Text

Clean up, transform and inspect text.

See all →

Numbers & Calculators

Dates, timestamps, units and quick maths.

See all →

Timestamp Converter

Convert Unix timestamps to dates, and back.

Stays on your device

Webhook Inspector