URL, HTTP & APIs
Webhook Payload Tester
Compose a webhook payload and headers, sign it the way real providers do, and copy a ready-to-run cURL, JavaScript or raw HTTP replay. Paste a received webhook in the Verify tab to check its HMAC signature. Nothing is uploaded and no request is ever sent.
Request
builderThe signature is computed over these exact bytes, so formatting matters.
Content-Type, the signature header and Content-Length are added automatically.
Signing
HMAC
Generic and GitHub sign the body only. Stripe signs timestamp + "." + body;
Slack signs v0:timestamp:body; Shopify returns base64.
Replay command
liveSignature header
computedHeader
Signed payload
Validation
analysisReceived webhook
stays on this pageInclude the request line and headers, then a blank line, then the exact body bytes.
Verification result
liveHow it works
Everything runs locally in your browser. The tool builds the request exactly as it would go on the wire, computes HMAC signatures with a self-contained SHA-256/SHA-1 implementation, and renders the replay command for you to run yourself. The Verify tab parses a pasted request, recomputes the signature over the raw body and compares it to the header. No data is uploaded, no request is sent and no secret leaves the page.