Webhook Tester
Sign a webhook payload the way Stripe, GitHub or Shopify do, check a signature you received, and send a test request. HMAC-SHA256 runs in your browser and the secret never leaves it.
Signature
Header name: —
Verify a received signature
Send a test request
The browser can only send this if the target allows your origin through CORS. If it fails, the signature panel still tells you exactly what would be sent.
History tool ini
Data terakhir yang pernah kamu isi di tool ini, tersimpan hanya di device/browser ini.
Save what you type here, in this browser? Your work would go into this browser's local storage, so a refresh or a trip to another tool does not wipe it. You also get a short list of previous entries under the form, each one restorable with a click. Nothing is ever uploaded, and there is no account.
Being straight about the trade-off: anything kept there can be read by anyone who can use this browser profile, and by any script that later runs on this site. A tool page can hold a private key, a password or a signed token. Saving is convenient; it is not private.
About this tool
A webhook workbench that runs entirely in the browser. Build a payload, sign it with HMAC-SHA256 in the format a provider expects, paste a signature you received to check it, or send the signed request to a test endpoint. The signing secret stays on your machine and is never uploaded.
Questions
- Which providers are supported?
- Stripe, GitHub, Shopify and a generic HMAC-SHA256 format. Each one signs a different string and wraps the result differently: Stripe signs the timestamp and payload and writes t= and v1=, GitHub writes sha256=, Shopify sends base64, and the generic format is plain hex.
- Why is the timestamp part of the signature?
- It lets the receiver reject an old request that someone replays later. Stripe includes the timestamp in the signed string and sends it alongside, so changing the timestamp invalidates the signature. Use the Now button to refresh it before sending.
- Why does sending fail with a network error?
- Browsers can only send a request when the target allows your origin through CORS, and a webhook endpoint usually does not. That is a browser rule, not a bug. The signature panel still shows exactly what would be sent, so you can test the signing even when the send is blocked.
- Is the secret safe?
- It never leaves the page: the HMAC is computed locally with the Web Crypto API and there is no upload step. Still, treat any secret you paste into a website as one you control, and prefer a test secret over a live one.