peekhook

The webhook tester that gets out of your way

Get an instant webhook URL, point any service at it, and watch requests arrive live - full headers, formatted JSON body, and the provider auto-detected. Free, no signup.

Your URL is ready below - the moment a request hits it, you jump straight to the inspector.

How it works

  1. 1
    Grab a URL

    Click the button above. You get a unique peekhook.com/xxxx-xxxx endpoint instantly.

  2. 2
    Send a webhook

    Paste the URL into Stripe, GitHub, your app, or a curl command. Any method, any payload.

  3. 3
    Inspect it live

    Requests stream into the inspector in real time. Read headers, pretty-printed body, and the detected provider.

Provider auto-detection

PeekHook recognizes signature headers from common webhook senders and tags each request with the provider and event type:

Verify webhook signatures

Confirm a webhook really came from the sender and was not tampered with. Open the Verify tab, paste your signing secret, and PeekHook checks the HMAC signature for Stripe, GitHub, Shopify and Slack - or any provider via a generic HMAC mode. The secret is used only in your browser through the Web Crypto API and is never sent to PeekHook.

FAQ

What is a webhook tester?

A webhook tester gives you a throwaway URL that captures HTTP requests so you can inspect exactly what a service sends - useful when building or debugging integrations before your real handler exists.

Is PeekHook free?

Yes. Capturing and inspecting webhooks is free with no signup. Sign in only if you want to keep an endpoint permanently.

How long do my requests stick around?

Anonymous endpoints keep a rolling buffer of recent requests and expire after a period of inactivity. Sign in to claim an endpoint and keep it.

Can it verify webhook signatures?

Yes. On a captured request, open the Verify tab, choose the provider (Stripe, GitHub, Shopify, Slack, or a generic HMAC) and paste your signing secret - PeekHook recomputes the HMAC and tells you whether the signature is valid. The secret never leaves your browser; verification runs locally via the Web Crypto API.