Built for payloads you don't want lying around.
Tracehook is a no-account webhook inspector: a capture URL receives your HTTP requests and shows them live. Here's what happens to the data it receives.
Encrypted at rest. Every request is encrypted (AES-256-GCM) before being stored.
Ephemeral. Erased 24 h after the last activity. Deletable immediately.
Nothing is executed. Received content is displayed as text, never interpreted by the browser.
No reflection. The capture URL never returns what it received.
Lockable. Add a password if the link might get forwarded: only an encrypted verifier is kept, never the password. Capture keeps working, only reading is blocked.
Password protection
A session can be locked with an optional password: the link alone is no longer enough to read its content. The password is never stored in plain text or logged — only a scrypt verifier is kept, in the same encrypted file as the rest of the session. It can't be recovered if you forget it. Capture keeps working while a session is locked: only reading is blocked.
Limits
- The last 50 requests per session; the oldest are deleted automatically.
- 1 MiB maximum per request, headers included (HTTP 413 beyond that).
- Session erased 24 h after the last activity, or immediately with one click.