Webhook.site and RequestBin Alternatives: Webhook Testers Compared

The best webhook.site alternative depends on what you are testing. To look at one payload without signing up, Svix Play, Hookdeck Console, webhook.cool and RequestCatcher do the same job for free. To return mocked responses, Beeceptor and Postman mock servers go further. To get events onto your laptop, the Hookdeck CLI, smee.io and the Stripe CLI forward them to localhost. If you would rather run it yourself, webhook.site and tarampampam/webhook-tester are both MIT licensed and ship as Docker images. RequestBin itself now lives inside Pipedream and needs an account.

We build Webhooker, an EU-hosted webhook gateway that also comes up when people outgrow a request bin, so read the last sections with that in mind. Every limit and price below links to the tool’s own site or repository, checked on 14 September 2026.

What does a webhook tester do?

A webhook tester gives you a public URL, records every HTTP request sent to it, and shows you the method, headers, query string and raw body. You paste the URL into Stripe, GitHub or whatever sends the webhook, trigger an event, and read exactly what arrived. That answers the first questions of any integration: which fields are in the payload, which signature header the provider uses, and whether the provider sends JSON or form data.

Most testers then add one or more of four things: a configurable response (status code, body, delay), forwarding to another URL or to localhost, a way to replay a captured request, and scripting that transforms or routes requests. Which of those you need decides the shortlist far more than the brand does.

Why look for a webhook.site or RequestBin alternative?

Webhook.site is a good tool, and it is not a data-residency problem: its terms name Webhook ApS in Odense, Denmark, hosting at Hetzner in Germany, and a DPA on request. People look elsewhere for other reasons.

The free tier is built for a quick look. A free URL holds 100 requests or emails and is removed after 7 days. That covers checking a payload shape and runs out during a load test or a week of staging traffic.

Free URLs are readable by anyone who has them. Webhook.site’s docs say free data “is accessible to anyone who knows the ID of the URL”. smee.io channels work the same way, and Postman mock servers are public by default. That is fine for stripe trigger fixtures and a problem the moment a real customer email lands in the bin.

RequestBin changed. The old public RequestBin is gone. requestbin.com now redirects to Pipedream’s RequestBin, which asks you to sign up before it creates a bin. Pipedream’s privacy page says data is hosted on AWS in us-east-1, and Workday announced it would acquire Pipedream in November 2025.

Security teams notice these domains. Public request bins are also a common exfiltration target in malicious packages. Checkmarx found webhook.site and pipedream.net used that way, and a 2025 Semgrep advisory describes npm malware that sent secrets to a webhook.site endpoint. Some corporate networks flag or block traffic to them as a result.

How do the webhook testers compare? (checked 14 September 2026)

Table: webhook.site and RequestBin alternatives compared on free limits, paid entry price, privacy, localhost forwarding and self-hosting. Every cell links back to the sources in the sections below.

Which webhook testers work without signing up?

For a one-off check, these give you a URL in seconds.

• Svix Play is “free forever, no signup required”. Its docs describe query parameters to force a status code, echo the body back, or fail a percentage of requests at random, which is handy for testing a sender’s retry logic.
• Hookdeck Console works without an account, remembers anonymous sources in your browser for up to 90 days, and gives you an ingest URL plus a separate inspect URL you can share with a colleague.
• webhook.cool keeps webhooks until 7 days of inactivity.
• RequestCatcher gives you a subdomain and streams requests to your browser tab as they arrive.
• typedwebhook.tools generates TypeScript, CUE and JSON Schema types from what it receives. The endpoint lasts 30 minutes and only your tab can read it.

None of these is meant to hold data for long, and only Hookdeck publishes a company and a DPA. Keep real customer data out of them.

Which webhook testers can return custom responses?

Some integrations need a specific reply before the sender considers the webhook delivered, and testing your sender’s retries needs failures on demand.

Beeceptor is the strongest here: mock rules decide the response per request. The free plan allows 50 requests a day per endpoint and 3 rules, and Individual costs $10 a month for 15,000 requests. Its terms are governed by Indian law, and the hosting location is not published. Webhook.site lets you set the default status, body, content type and a delay of up to 30 seconds, while its scripted Custom Actions need a paid plan. Postman mock servers answer from saved examples and come with Postman’s plans. Svix Play covers the simple cases with query parameters.

Webhooker also has a custom acknowledgement per source, so a provider that expects a particular status code or body gets it. It is not a mocking tool, though: the reply is fixed per source, without rules.

How do you test a webhook on localhost?

You need something with a public URL that relays each request to your machine. These testers do it without a general-purpose tunnel:

• Webhook.site CLI. whcli forward forwards a webhook.site URL to a local endpoint and works with anonymous tokens.
• Hookdeck CLI. hookdeck listen forwards to a local port, is free, and works as a guest.
• smee.io. smee-client relays a channel to localhost over Server-Sent Events. It is the default for GitHub Apps built with Probot, and payloads are never stored on the server.
• Stripe CLI. For Stripe only, stripe listen --forward-to needs no registered endpoint and prints its own signing secret. Our Stripe webhooks guide covers that loop.
• Webhooker CLI. It forwards the webhooks arriving on a Webhooker source to a local URL and can stream event metadata to your terminal. The source URL stays the same, and events that arrive while your laptop is closed stay in the source’s history.

If you would rather use a tunnel such as ngrok, Cloudflare Tunnel or Tailscale Funnel, we compare them in ngrok alternatives for webhooks. The short version: a relay keeps working when your laptop sleeps, and a tunnel does not.

Can you self-host a webhook tester?

Yes, and it is the simplest way to keep test payloads on infrastructure you control.

• webhook.site is MIT licensed, with a Dockerfile and a Helm chart. The open-source edition does not include Custom Actions.
• tarampampam/webhook-tester is a single Go binary with a built-in UI, MIT licensed. It supports a custom response code, headers, body and delay, storage in memory, Redis or the filesystem, live updates over WebSocket, and a built-in ngrok tunnel.
• smee.io runs from ghcr.io/probot/smee.io and needs Redis only for multiple instances.

The original Runscope RequestBin repository no longer exists, and Kong’s Mockbin stopped creating bins in 2023. Tutorials that point at either are out of date.

Is it safe to send real webhooks to a public request bin?

For test fixtures, yes. For production events, usually not. A webhook payload from a payment provider or a store carries names, emails, addresses and order contents, and a free bin that anyone with the URL can read is an uncontrolled copy of that data. Under GDPR, sending it there is a disclosure to a service you have no agreement with. We go through which fields count as personal data in are webhooks personal data?

Three habits keep testing safe. Use the provider’s test mode and fixtures, such as stripe trigger, instead of live events. Use a bin that requires login or runs on your own server as soon as real data is involved. And delete or rotate the URL once the test is over, since URLs leak through logs and screenshots.

When is a webhook tester no longer enough?

A tester answers “what did the provider send?”. It is not built to answer “did my system process every event?”. The gap shows up when a staging environment starts depending on the bin, when a teammate asks for last week’s events, or when a missed webhook costs money. At that point you need the webhook stored durably, its signature checked, and failed deliveries to your service retried and replayable.

That is the job of a webhook gateway. Webhooker gives each source a stable ingest URL that only your workspace can read. It verifies Stripe, GitHub and Shopify signatures or a generic HMAC before accepting the request, retries failed deliveries with a circuit breaker, keeps a dead-letter queue with replay, and shows events live in the dashboard or forwards them to localhost through its CLI. Data stays on servers in Germany. The free plan covers 10,000 events a month with 14-day retention, which covers a typical staging environment.

For a quick look at a single payload, webhook.site or Svix Play is still faster, since neither needs an account. Use a gateway once the events need to arrive somewhere.

Frequently asked questions