API Request Tester
Web & network Network on demand
Webhook Signature & Payload Tester
Local Web CryptoGenerate and verify byte-exact webhook HMAC signatures with provider presets and test cases.
Payload, secret, and signatures stay in memory. This static tool does not receive public webhooks.
{
"action": "opened",
"repository": {
"id": 1296269,
"full_name": "nobuf/example"
}
}UTF-8 bytes
99
JSON
Valid JSON
Event type
—
ID
—
Signature evidence
Ready to verify exact webhook evidence
Generate a test signature or paste a captured provider header, then run verification.
Negative test matrix
Server verification example
// Read raw request bytes before JSON parsing. Never log the secret.
const crypto = require('node:crypto')
const signed = rawBody
const expected = crypto.createHmac('sha256', secret).update(signed, 'utf8').digest('hex')
// Compare decoded bytes with crypto.timingSafeEqual after validating lengths.How to use it
- 01
Choose a signing scheme
Select a provider preset or generic HMAC algorithm and keep the signing secret only in browser memory.
- 02
Provide exact evidence
Paste or open the unchanged UTF-8 payload, signature header, and timestamp while keeping formatted JSON separate.
- 03
Verify and reproduce
Inspect signature and replay checks, run deterministic negative cases, export a secret-free report, and copy server verification code.
Frequently asked questions
Can this page receive a public webhook?
No. A static browser tool has no public server endpoint. It verifies captured evidence locally and helps reproduce receiver-side code.
Why does JSON formatting break a valid signature?
Signatures cover exact bytes. Whitespace, line endings, key order, or encoding changes create a different HMAC even when the parsed JSON value looks equivalent.
Are the secret and payload uploaded or saved?
No. Web Crypto runs locally, and the workspace does not put secrets, payloads, or signatures into persistent browser storage.
Does a valid signature prevent replay attacks?
Not by itself. Timestamped providers need a server-side tolerance check and durable event or delivery ID deduplication in your application.
Related tools
Keep working with other focused browser utilities.