AnyTool
Your files never leave your device. All processing happens locally in your browser.

How do I test and verify a webhook signature?

Pick a provider template (Stripe, GitHub, Slack, Shopify, and more), edit the JSON payload, and AnyTool computes the correct HMAC or Ed25519 signature header in your browser. Paste a real payload, signature, and secret to verify pass/fail, then send a test POST to your own endpoint.

  • Build provider-shaped payloads for Stripe, GitHub, Slack, Shopify, Twilio, Discord, and more
  • Generate correct signature headers (Stripe t=,v1=; GitHub sha256=; Slack v0=; Ed25519 for Discord)
  • Verify a captured payload + signature + secret with a live pass/fail badge
  • Send a test POST via fetch, with copy-as-curl for CORS-blocked endpoints
  • 100% in-browser — production signing secrets never leave your device

What is

Webhook Signature Verification

Webhook signature verification confirms that a webhook payload genuinely came from the provider and was not tampered with, by recomputing an HMAC (or Ed25519) signature over the exact raw body using a shared secret and comparing it to the signature header the provider sent.

Developer Tools

Related terms

HMAC-SHA256Webhook SecretEd25519Standard WebhooksRaw Body

Frequently Asked Questions

No — receiving external webhooks needs a public server; this tool builds, signs, sends, verifies, and inspects them client-side.

A 100% client-side tool has no public URL, so it cannot catch real webhooks that a provider POSTs to you — that requires a server or a tunnel like ngrok or the Hookdeck CLI. What it does do, entirely in your browser, is build provider-shaped payloads, generate and verify signatures, send test POSTs to your own endpoint, and inspect any payload.

Stripe, GitHub, Slack, Shopify, Twilio, SendGrid, Mailgun, Discord (Ed25519), Standard Webhooks, and custom HMAC.

It covers HMAC-SHA256/SHA1 in each provider format — Stripe t={ts},v1={sig}, GitHub sha256= (and legacy sha1=), Slack v0= over a timestamped basestring, Shopify base64 HMAC, Twilio SHA1, and Standard Webhooks — plus Discord Ed25519 verification with the application public key, all via WebCrypto.

Yes — all signing and verification run in your browser; secrets are never uploaded.

Every signature is computed locally with WebCrypto, so you can paste a production whsec_ secret safely — it never touches a network, unlike server-based webhook catchers. The build, sign, verify, and inspect flow works fully offline; only the optional live Sender needs network access.

Detailed Explanation

Methodology

How the Webhook Tester Works

AnyTool provides an end-to-end outbound webhook workflow in one tool: build a provider-shaped JSON payload from templates (Stripe, GitHub, Slack, Shopify, Twilio, SendGrid, Discord, Mailgun, Standard Webhooks, or custom), sign it with the correct header format using WebCrypto HMAC-SHA256/SHA1, verify a captured payload against a signature and secret, send a test POST to your own endpoint via fetch(), and inspect any payload as a JSON tree. Signatures are computed over the exact raw body, and the signed bytes are shown so the common raw-body mismatch bug is easy to spot.

  • Build → Sign → Send → Verify → Inspect in one client-side tool
  • Provider formats: Stripe t=,v1=; GitHub sha256=; Slack v0=; Shopify base64
  • Discord Ed25519 verification with the application public key
  • Live signature recompute and pass/fail badge on keystroke
  • TypeScript and JSON Schema export from any pasted payload
Limitations

What It Cannot Do: Receive Live Webhooks

A fully client-side tool has no public URL and cannot receive real webhooks that a provider POSTs to you — that structurally requires a public server or a tunnel such as ngrok or the Hookdeck CLI. The tool is honest about this and instead owns the half of the workflow that is genuinely better client-side. The live Sender is also subject to CORS, so when an endpoint blocks the response the tool offers copy-as-curl and copy-as-fetch fallbacks.

Privacy & Security

Privacy and Offline Use

Every signature is generated and verified locally with WebCrypto, so a production whsec_ secret can be pasted safely and never touches a network — unlike server-based webhook catchers that require sending payloads and secrets to their servers. The build, sign, verify, and inspect flow works fully offline; only the optional live Sender needs network access.

Webhook Tester: AnyTool vs typical tools
CapabilityAnyToolCatcher toolsSigner tools
Build + sign + send + verify + inspectAll fiveInspect onlyOne or two
Provider coverage (8+ incl. Ed25519)YesN/AUsually 3
Secrets stay on deviceYesNo (server)Usually
Receive live external webhookNo (needs server)YesNo
Works offlineYesNoVaries

Catcher tools (e.g. webhook.site) receive real webhooks server-side; AnyTool focuses on the client-side build/sign/verify loop.