RunLocalTools

Webhook Payload Sandbox — Test, Verify & Explore Webhooks Free

Paste any webhook payload for a navigable tree view, verify Stripe/GitHub/Shopify/Slack signatures, and replay requests to your own endpoint — all in your browser.

What it does

Paste a JSON payload — or pick a ready-made sample from Stripe, GitHub, Shopify, Twilio, or Slack — to get a collapsible, searchable tree view. Beyond viewing it, you can verify a provider’s signature against your webhook secret, pull a single value out with a dot-path, and replay the exact request to your own local endpoint.

How it works

  • Provider-correct signature verification — Stripe, Slack, GitHub, and Shopify each sign a different string and encode the result differently (hex vs. base64); the tool builds the right message for whichever scheme you pick and checks both encodings, so a scheme mismatch is flagged instead of silently reported as “invalid.”
  • Smart auto-unwrap — payloads copied out of a log line often arrive double-escaped as a JSON string containing more JSON. Paste it as-is and the tool recursively unwraps it back to the real object.
  • Dot-path lookup — pull any nested value (data.object.id, line_items[0].title) without hunting through the tree by eye.
  • Real replay — sends an actual POST request, with your headers and body, to a URL you provide — useful against a local dev server or an ngrok tunnel.

How to use it

  1. Paste a payload, or pick a sample provider to start from a realistic example.
  2. Use the search box to filter the tree to matching keys or values.
  3. To verify a signature: pick the provider scheme, paste your secret and the signature header value, and compute — it tells you whether it matches, and flags it if you picked the wrong encoding.
  4. To replay the request, enter your endpoint URL and send — the response status and body come back inline.
  5. Copy the request as a ready-to-paste curl command if you’d rather test from a terminal.

FAQ

Why doesn’t my Stripe/Slack signature match, even with the right secret? Those two don’t sign the raw body — Stripe signs timestamp + "." + body, Slack signs "v0:" + timestamp + ":" + body. Make sure you’ve picked the matching scheme and pasted the timestamp alongside the secret.

Why does Shopify’s signature look nothing like GitHub’s? Shopify encodes its HMAC digest as base64; GitHub (and the generic scheme) uses hex. Same underlying HMAC, different representation.

Is the “replay” feature actually sending my data somewhere? Only to the URL you type in — nothing goes anywhere unless you enter an address and click Send. It won’t work against most production APIs due to CORS, but it’s built for testing against your own local server.

What if my pasted payload doesn’t look like valid JSON? Try “Auto-unwrap escaped JSON” first — a lot of “invalid” payloads are actually valid JSON that’s been escaped once or twice.

Is my payload or secret sent anywhere? No — parsing, signature computation, and the tree view all run entirely in your browser. Only “replay” makes an outbound request, and only to the URL you provide.

Can I compare two payloads to see what changed? This tool handles one payload at a time. For a structural diff between two, use the JSON diff tool — or the JSON formatter if all you need is to pretty-print or minify.