Webhook Payload Tester

// HOW TO USE

1. 01Choose a mode: Build (generate a signed payload) or Verify (check a payload + signature).
2. 02Build: pick a provider template, enter your signing secret → get the JSON body, signature header, and a curl command.
3. 03Verify: paste the received payload, the signature, and your secret → see the computed vs received HMAC.
4. 04Everything is computed locally; copy the payload or curl to replay against your handler.

// WHEN TO USE

Use in two scenarios: (1) Build mode — you're writing a webhook handler and need a realistic signed payload to test against without triggering a real event; (2) Verify mode — you have a payload and signature from a provider and want to confirm your signing secret and algorithm produce the expected HMAC-SHA256 match. All computation is local; the secret and payload never leave your browser.

// WHAT BUGS THIS FINDS

• Wrong HMAC encoding — hex vs base64

  Stripe uses hex; some providers use base64. Using the wrong encoding produces a valid HMAC value that never matches, causing all webhooks to be rejected silently.

• Signature header not verified — trust without check

  A handler that processes the payload without verifying the HMAC accepts forged events from anyone who knows the endpoint URL.

• Signature verified on modified payload

  Logging middleware that compresses or reformats the body before the handler reads it changes the payload bytes — HMAC verification always fails.

// QA USE CASES

// Related