01 /
Catch what failed.
When retries run out, the story should not end. Keep the failed delivery, its response, and the context you need.
504 timeout → saved to inboxTHE WEBHOOK INBOX THAT KEEPS WHAT FAILS
Failed webhooks.
Second chances.
Stop ssh-ing into production for failed JSON. Hookjail keeps every delivery your app missed, shows a safe preview, and replays the exact request once your fix is live.
Free plan: 1 endpoint, 1,000 deliveries a month. No card, no password.
Redacted by default. Deliberate by design.
invoice.payment_failed
FailedStripe · received 2 minutes ago
1
{2
"id": "evt_1NxK2qLk8f21c4",3
"type": "invoice.payment_failed",4
"data": {5
"customer_email": "••••••••",6
"amount": "••••••••",7
"currency": "usd"8
}9
}Response
504 timeoutAttempts
5 of 5Payload
RedactedExample deliveryHow replay works
Back on track.
187 msReplay succeeded · 200 OK
One inbox. The providers you already use.
Stripe◈ ShopifyGitHubPaddle& your own webhooks
FROM FAILED TO FIXED
Less log diving. More getting on with it.
No SSH sessions to find a missing JSON body. No improvised curl commands at 3am. Just three deliberate steps.
02 /
See the whole story.
Inspect a redacted payload alongside stored headers and every attempt. Understand the failure without exposing customer data. Reveal the original only with a written reason.
"customer_email": "••••••••"03 /
Give it another go.
Fixed the handler? Dry-run it, then replay the exact bytes with a fresh Hookjail signature. You are warned before repeating an event that already went through.
replay → 200 OK → back to buildingA LITTLE LESS TO WORRY ABOUT
Sensitive payloads.
Sensible defaults.
Recovery should feel controlled. Every screen makes it clear what you can see, what will happen, and what gets recorded.
Explore the security approachA safe preview comes first
Names, e-mails, amounts and card numbers are masked. Search covers metadata only, never payloads.
Every reveal has a reason
A written reason and an audit entry come before the original is shown, and the view closes itself.
Replay with the full context
Dry run first. Every replay is signed, and you are warned before repeating a delivered event.
Retention has a clear endpoint
You choose how long originals are kept. After that the record stays and replay stops.
PLANS
Start free. Paid plans are on the way.
The Free plan is open now. Replay, alerts and longer retention come with the paid plans, and pricing is not announced yet. Leave your email and we write once, when they open.
Free
Capture and inspect, with nothing to pay.
Free
- 1 endpoint
- 1,000 deliveries a month
- Redacted previews and full attempt history
- Originals kept 2 days, records 14 days
- Dry run (replay is a paid feature)
Solo
For one product with real traffic.
Pricing soon
- More endpoints and a much higher monthly volume
- Replay, signed, with a dry run first
- Alerts when deliveries keep failing
- Originals kept for months
Team
For several services and people.
Pricing soon
- Many endpoints and a high monthly volume
- Everything in Solo
- More alert rules
- Originals kept for up to a year
THE DETAILS
Good questions.
A few things you might want to know before handing over your webhooks.
Read the quickstartHow does Hookjail fit into my stack?
Create an endpoint, paste its Hookjail URL into your provider, and point it at your existing webhook handler. Hookjail stores each delivery, forwards it, and returns your handler’s real answer, so the provider’s own retries keep working. Failures land in your inbox.
Will replay create duplicate charges or emails?
It can if your application does not enforce idempotency. The replay flow shows the destination, previous replays, and original event key before you confirm. Your handler must use that key to prevent duplicate effects.
What will Hookjail cost?
The Free plan is open now and costs nothing. Replay, alerts and longer retention will be paid features. Pricing is not announced yet; people on the email list for paid plans hear about it first.
Who can access the original payload?
Signed-in members of your workspace, and only through Reveal payload: it needs a written reason, is recorded in the audit log before the data is shown, and closes after five minutes. Payloads are encrypted with a per-workspace key. Today the master keys live in Cloudflare Worker secrets; the security page lists exactly what we do and do not claim.
Your first endpoint is one email away.
No password, no card. We email you a one-time link and your workspace is ready.