Paste a request.
Watch it go .
Stubsmith masks fail-closed: every value is hidden unless a rule explicitly keeps it. What reaches us is structure (key names and shape), never contents. Everything below runs in this page, on your machine. Nothing is sent anywhere.
Start free →This playground demonstrates the email, UUID and card substitutions. The remaining types come from the same per-project config.
Masked values keep their shape
Each type gets a safe stub: an email becomes a valid stub address, a UUID becomes a zeroed UUID, a card number becomes a test card number. Only free-form strings collapse to <masked>. Your stubs still parse, validate, and route the way production values do.
Numbers become 0, booleans false
Fail-closed masking preserves structure and key names only. The shape stays useful for generating stubs; the contents are gone before the request leaves your process.
The fingerprint is real
Method and path template, plus a blake2b-64 digest over the request's sorted key-paths, query names and content type. By default no value is an input; opt a field in as a variant key and only that value joins the hash. The Fingerprint tab shows exactly what goes in.
How it works
From real traffic to test fixtures in four steps, with privacy preserved throughout.
Capture real traffic
Add the Stubsmith SDK to your service with a single line. It intercepts outbound HTTP calls and records request/response pairs into a local capture buffer.
SDK masks at the edge, before data leaves
Before a byte leaves your infrastructure, the SDK applies your masking rules. Unless a keep rule explicitly permits a value through, every value is replaced with a typed stub: strings become
<masked>, emails become a stub address, numbers become 0. What leaves your process is masked structure, not content.Stubsmith stores masked samples and fingerprints
Stubsmith persists the masked body and a structural fingerprint of the request/response shape. The fingerprint contains no payload data, only enough structure to detect duplicates and organize stubs.
Generate stubs, fixtures, and replay in CI
Export stubs as OpenAPI, JSON fixtures, WireMock mappings, or MSW handlers. Wire them into your test suite and replay against your CI pipeline. No live API calls needed, no token leaks, deterministic results.
Built for the privacy-conscious team
Every design decision starts with the question: what happens to production data?
Edge masking, before data leaves
Masking runs in the SDK, inside your own infrastructure. Stubsmith's servers receive masked bodies and field names, never raw values from your users. No cleartext sample data reaches our servers.
Stubs from real traffic
Capture the APIs your service actually calls, not an approximation. Stubs reflect real schemas, error shapes, and timing behavior.
Fingerprint deduplication
Stubsmith deduplicates traffic by structural fingerprint, so you get one canonical stub per API shape, not thousands of near-identical captures.
EU-sovereign hosting
Hosted on UpCloud and Scaleway, with all data stored in Amsterdam, NL.
Privacy stance
We don't want your customers' data
Most API tools process production traffic on their servers. Stubsmith is built around the opposite premise: your users' personal data should never reach us in the first place.
Masked before it leaves
The SDK replaces every value with a typed stub inside your own infrastructure: emails become stub addresses, card numbers become test numbers, free-form strings become
<masked>. Masking runs before any network call is made.Structure only, never content
Stubsmith's servers receive masked bodies and field names. We see that you have a field called
receipt_emailof type string. We never see the email address it contained.Fail-closed by default
Every unknown value is masked. A new field in an API response is masked until you explicitly add a keep rule for it. The conservative path is the automatic path.
The test-fixture problem has a privacy problem
Most teams solve the test-fixture problem by copying production data. That copies PII, credentials, and confidential payloads into developer laptops, CI logs, and staging databases, where they stay indefinitely.
Stubsmith's approach is different: masking happens at the SDK, before the data leaves your network. The server sees structure and masked values, not content. Your stubs are accurate without your users' personal data ever reaching our infrastructure.
- No production data in CI. Masked values contain no useful information. Types are preserved; content is replaced before anything leaves your process.
- Accurate stubs, not hand-crafted mocks. Generated from the real API, so schema drift is caught at the next record cycle, not six months later in a prod incident.
- Retention windows, not indefinite storage. Samples expire on plan schedule. Fingerprints and stubs are yours to keep.
Frequently asked questions
- Does Stubsmith see my API request/response bodies?
- No. The SDK masks every request and response body fail-closed: values are replaced with typed placeholders before anything leaves your infrastructure. Stubsmith receives masked bodies and field names, never raw values. No cleartext sample data reaches our servers.
- What's a fingerprint?
- A fingerprint is a structural signature of a request/response shape. Stubsmith deduplicates traffic by fingerprint and tracks them per plan. Fingerprints are capped by plan. When you hit the cap, new shapes are rejected at ingest with a clear error and dashboard banner. Existing fingerprints are never deleted; they are your durable asset.
- How long are samples kept?
- Sample retention depends on your plan: 24 hours (Free), 7 days (Solo), 30 days (Team), 90 days (Business). Fingerprints, request types, and generated stubs are kept indefinitely; they are the output, not temporary data.
- Where is my data hosted?
- All infrastructure runs in the EU. Compute is on UpCloud infrastructure in Amsterdam (nl-ams); the database is UpCloud Managed PostgreSQL in the same region. UpCloud is a Finnish company. Object storage is on Scaleway in Amsterdam. No data transits to US-based services.
- How does billing and VAT work?
- Prices are shown including VAT by default. Checkout and billing run through Creem, our merchant of record: Creem is the seller of record, charges the VAT that applies to your billing country, remits it, and emails your receipt. You can cancel any time from the dashboard. Annual plans are available at a discount.
Start with the free plan
One project, 50 fingerprints, no credit card required. Evaluate the full flow on a single service.