How to use the Webhook Tester
- Your unique webhook URL is created automatically — click Copy URL.
- Paste it into the webhook settings of the service you are testing (GitHub, Stripe, Shopify, Slack, Zapier…) or call it with curl.
- Requests appear live on the left. Click one to see its headers, query string and body.
- Paste your signing secret in Verify signature to check the HMAC the sender attached.
What is a webhook tester?
A webhook is an HTTP request a service sends to your URL when something happens — a payment succeeds, code is pushed, an order is placed. While you build the receiver, you need to see exactly what arrives: which headers, what JSON shape, how the signature is computed. A webhook tester gives you a temporary public URL that records every request so you can inspect it, without writing or deploying any code.
What you can inspect
- Method and path — anything after your URL is captured, so you can use
/orders,/refundsetc. to tell events apart. - Headers — content type, user agent, event names (
X-GitHub-Event,Stripe-Signature,X-Shopify-Topic) and delivery IDs. - Query string and body — JSON is pretty-printed, form posts are decoded into a table, binary bodies are shown as base64.
- Signature check — recomputes the HMAC-SHA256 the provider sent, using your signing secret, entirely in your browser.
Signature schemes supported
| Provider | Header | What is signed |
|---|---|---|
| GitHub | X-Hub-Signature-256: sha256=… | Raw body, hex |
| Stripe | Stripe-Signature: t=…,v1=… | timestamp.body, hex |
| Shopify | X-Shopify-Hmac-Sha256 | Raw body, base64 |
| Generic | any header you choose | Raw body, hex or base64 |
Testing from your laptop
Webhook providers can’t reach localhost. Use this URL to learn the payload format first, then build your handler and test locally with the provider’s CLI (stripe listen, gh webhook forward) or a tunnel. Always verify signatures and respond with a 2xx status quickly — most providers retry on timeouts and errors.
Limits and privacy
Each URL keeps its latest 50 requests for 24 hours, accepts bodies up to 256 KB and up to 120 requests a minute. The URL itself is the key: anyone who has it can send to it and see its requests, so don’t send real customer data or production secrets. Format captured payloads with the JSON formatter, decode tokens with the JWT decoder, or build HMACs with the HMAC generator.
Tools that pair well with the Webhook Tester
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.
- MIME Type Lookup — Search 200+ file extensions and MIME types — .webp, .woff2, .webmanifest, application/wasm … — or drop a file to detect its real type from its first bytes.
- Subnet Calculator — Enter an IP with a prefix (10.0.0.0/22) or a subnet mask (192.168.1.10 255.255.255.0) to get the network, broadcast, usable hosts and binary breakdown — and split it into subnets.
- URL Parser — Paste a URL to see every component and decoded query parameter — then edit, add or remove parameters and copy the rebuilt URL.