Webhook Tester
Validate webhook payloads live and sign them with HMAC — SHA-1 / SHA-256 / SHA-512. Secrets stay in memory only.
About this ToolHow it works, benefits & use casesTap to collapse
Inspect and sign webhook payloads before you wire up a real endpoint. As you type a payload, the tool validates it against the chosen content-type: JSON is parsed and checked for the fields most providers send — an event identifier (event/type/action), a timestamp (timestamp/created_at/createdAt), and a unique id (id/uuid/event_id) — surfacing missing ones as warnings rather than hard failures. XML and form-urlencoded payloads get lighter structural checks, and oversized payloads (over 1MB) are flagged. A live byte counter sits in the payload header. The HMAC panel signs the exact payload with a secret using SHA-1, SHA-256, or SHA-512 via the Web Crypto API, producing a hex digest and a ready-to-paste header (X-Hub-Signature for SHA-1, X-Hub-Signature-256, or X-Hub-Signature-512). Everything assembles into a request preview showing the method, headers, and body. Authorization tokens and signing secrets are held in memory only and never persisted.
How to Use
- 1Fill in the Webhook URL, HTTP method, and Content-Type; optionally add an Authorization token (kept in memory only).
- 2Type or paste your payload, or pick an event type (user.created, payment.succeeded, order.shipped) and click "Load example".
- 3Watch live validation report whether the payload is valid plus any missing-field warnings, and check the byte count in the header.
- 4Click "Validate payload" to confirm it parses, then enter a Secret, pick an HMAC Algorithm, and click "Sign payload".
- 5Copy the generated signature header and the assembled request preview (method, headers, and body) for use in your tests.
Key Benefits
- Live JSON validation with provider-aware warnings for missing event, timestamp, and id fields
- HMAC signing in SHA-1, SHA-256, or SHA-512 via the browser's Web Crypto API
- Pre-formatted signature headers: X-Hub-Signature, X-Hub-Signature-256, X-Hub-Signature-512
- Built-in example payloads for user.created, payment.succeeded, and order.shipped events
- Live byte counter and 1MB oversize warning
- Request preview combining method, headers, signature, and body
- Auth tokens and signing secrets stay in memory — never written to storage or share links
Common Use Cases
- Verifying your HMAC signature logic matches what a provider like GitHub or Stripe sends
- Computing a valid signature header to replay a test webhook against your own endpoint
- Checking that a hand-written payload includes the event, id, and timestamp fields your handler expects
- Confirming a payload is valid JSON and within size limits before integrating
- Demonstrating webhook signing to a teammate without sharing the secret
Request configuration
Kept only in memory for this session.
0 bytes · live validation
HMAC signature
Used to compute HMAC; never persisted.
Method, headers and payload (signature included when signed)
Configure the request above to see the preview.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- JSON FormatterFormat and validate JSON with syntax highlighting
- Console.log RemoverRemove console statements from your JavaScript code
- Regex TesterTest and debug regular expressions
- Stack Trace FormatterBeautify and analyze JavaScript stack traces
- XSS DetectorScan input for XSS vectors by category and severity, encode it safely for any context (HTML, attribute, JS, URL, CSS), and browse a payload and sanitization reference
- SQL Injection TesterAnalyze a query for injection risk with a graded report and secure rewrite, plus a categorized reference of injection classes (UNION, blind, error-based, stacked) and their defenses
It computes HMAC with SHA-1, SHA-256, or SHA-512 using the Web Crypto API. The result is a lowercase hex digest plus a formatted header — X-Hub-Signature for SHA-1, X-Hub-Signature-256 for SHA-256, and X-Hub-Signature-512 for SHA-512 — with the value written as algorithm=digest, matching the GitHub-style convention.
For JSON content-types it parses the payload and warns when it is missing a common event identifier (event, type, or action), a timestamp (timestamp, created_at, or createdAt), or a unique id (id, uuid, or event_id). These are warnings, not errors — only unparseable JSON, missing required structure, or empty payloads fail validation.