DEV Community

Eduardo fernandes da silva
Eduardo fernandes da silva

Posted on

I Built a Free Browser Tool to Debug Stripe Webhooks (No Signup, No Server)

#api #debugging #javascript #security

I lost a weekend to a Stripe webhook that returned 200 OK but never fulfilled orders.

The culprit? I was parsing the JSON body before verifying the Stripe-Signature header. The payload looked valid. The handler ran. But the signature was wrong — so I was processing forged or replayed events without knowing it.

That pain became HookReplay — a free, browser-only webhook debugger for Stripe and SaaS developers.

What it does

  • Paste any webhook payload → instant field inspection (event type, livemode, amount, status)
  • Verify Stripe-Signature headers with HMAC-SHA256 using Web Crypto API
  • Flags 8 silent failure modes that kill revenue: retry storms, idempotency gaps, test/live mix-ups, dead endpoints, and more

Everything runs client-side. No signup. No API keys sent to a server.

Why browser-only?

Webhook debugging usually means:

  1. Spinning up ngrok
  2. Tail-ing production logs
  3. Copy-pasting into Postman
  4. Hoping your local secret matches production

HookReplay cuts that loop to 30 seconds. Paste payload, paste signature header, paste secret — done.

The 8 failure modes it catches

  1. Signature skipped — parsing before verify
  2. Retry storms — no idempotency key handling
  3. Test/live mix-ups — livemode: false in production
  4. Dead endpoints — 200 returned but handler never ran
  5. Timestamp drift — signature tolerance exceeded
  6. Wrong secret — test secret on live events
  7. Duplicate events — same event.id processed twice
  8. Silent timeouts — webhook ack'd before async work finished

Try it free

🔗 HookReplay: https://produtosagentes.vercel.app

No account needed. Works on mobile too.

Go deeper with the Pro Playbook ($19)

If you want production-ready templates:

  • Replay scripts for local testing
  • Idempotency middleware (Node/Python)
  • Production webhook checklist

Available via the upgrade button on the tool page.

What's the worst webhook bug you've hit? Drop it in the comments — I'll add the most common ones to the failure-mode detector.

Built with vanilla JS + Tailwind. Zero dependencies. Because debugging tools shouldn't need their own debugger.

Top comments (0)