Webhook Payload Inspector

Parse a webhook, check timestamp freshness, verify an HMAC signature, and generate a replay snippet. Everything stays in this browser.

Secret safety: use a test signing secret when possible. This page makes no network requests and does not store inputs, but secrets remain visible to browser extensions and anyone with access to this tab.

HTTP method

Replay URL

Headers (one Name: value per line; max 100)

Raw payload (maximum 1 MiB)

Parse as

Freshness tolerance (seconds)

Signature verification

HMAC algorithm

Signature encoding

Received signature

Signing secret

Timestamp (Unix seconds or ISO 8601)

Signed content

Inspection results

Parsed payload

—

Request summary

—

Replay cURL

Replay Fetch snippet

Replay code is generated only; this tool never sends the request. Review headers and remove production credentials before sharing or running it.