URL, HTTP & APIs

Webhook Payload Tester

Compose a webhook payload and headers, sign it the way real providers do, and copy a ready-to-run cURL, JavaScript or raw HTTP replay. Paste a received webhook in the Verify tab to check its HMAC signature. Nothing is uploaded and no request is ever sent.

Runs in your browser v1.0.0

Request

builder

The signature is computed over these exact bytes, so formatting matters.

Headers

Content-Type, the signature header and Content-Length are added automatically.

Signing

HMAC

Generic and GitHub sign the body only. Stripe signs timestamp + "." + body; Slack signs v0:timestamp:body; Shopify returns base64.

Replay command

live

                        

How it works

Everything runs locally in your browser. The tool builds the request exactly as it would go on the wire, computes HMAC signatures with a self-contained SHA-256/SHA-1 implementation, and renders the replay command for you to run yourself. The Verify tab parses a pasted request, recomputes the signature over the raw body and compares it to the header. No data is uploaded, no request is sent and no secret leaves the page.