Debug webhooks on your machine.

hook-local receives, inspects, verifies, and replays webhooks locally. Payloads live in a SQLite file on your laptop, not someone's cloud.

Get early access See how it works
hook-local event list showing captured webhooks with verified and replayed badges

The whole debugging loop, one tool.

Receiving the request is the easy part. hook-local keeps going: it shows you the exact bytes, proves the signature math, and lets you fire the event again.

Byte-exact signature verification

HMAC-SHA256 over the raw request body with a timing-safe compare. Configure the header, prefix, and encoding per service, then see the received and computed signatures side by side. You learn why a signature fails, not just that it failed.

Event detail view with headers, raw body, and a valid signature verification result

Replay with retry rules

Edit the body, re-sign it with a stored secret, and send it to any endpoint with timeout, retry count, and interval you control.

Break things on purpose

Tell the inbox to answer 500 or stall for two seconds, then watch how Stripe or GitHub retries against you.

Nothing leaves your machine

Events live in local SQLite, secrets are encrypted at rest, sensitive headers are masked. Export it all as JSON when you choose to share.

Running in under a minute.

# requires Node.js 20+ npx hook-local # point any webhook at your inbox, or test it right away: curl -X POST http://127.0.0.1:8788/inbox/default \ -H "Content-Type: application/json" -d '{"hello":"world"}' # {"received":true,"eventId":"..."}

Why not the usual suspects?

webhook.site Great for a quick look, but your payloads sit on their servers. Fine for demos, awkward for payment data.
ngrok Gets traffic to your laptop, then leaves you alone. Inspecting, verifying, and replaying it is still your problem.
A throwaway Express server console.log is not a debugger. No history, no signature math, no replay, and you delete it next week.