← All Tools
Webhook Test🔒 100% local
QA a webhook payload: JSON validity, event discriminator, idempotency key, timestamp and size. Privacy-first, no server uploads, no tracking.
Related Tools
Webhook Test is a static analyser for the payload text you paste, not a sender. It parses the body as JSON, pretty-prints it, and lists what a receiver will want: an event or type discriminator, an id for de-duplication, a timestamp, a data wrapper, plus an approximate byte size. It also recognises a curl command or a raw header block and comments on what those carry. The page inspects the string and stops there - it opens no connection.
How to use it
- Paste the captured webhook body, a curl command, or the raw headers into the Input box.
- Press Process.
- Work through the checks and the Issues to fix list, then use the receiver checklist as a to-do list for the endpoint you are writing.
Worked example
{"event": "test"}becomesDetected: object with 1 top-level key(s)
JSON parsed and pretty-printed below.
Checks passed:
✓ Valid JSON — parsers will accept it.
✓ Has an event/type discriminator — good, handlers can route on it.
✓ No id/delivery_id — without one, receivers cannot de-duplicate a retried delivery.
✓ No timestamp — add one (ISO 8601 UTC) so receivers can detect stale deliveries.
✓ Payload is flat — consider a data wrapper so you can add metadata later without breaking clients.
✓ Payload size: ~16 bytes.
No structural issues found.
--- Formatted payload ---
{
"event": "test"
}
Top-level keys: event
Receiver checklist:
• Verify the signature over the RAW body (not a re-serialised object — key order changes and the HMAC will not match).
• Compare with a constant-time function, e.g. crypto.timingSafeEqual, not ===.
• Wrap the whole handler so a verification failure returns 401 immediately.
• Return 2xx fast (<5s) or the sender will retry — do the work asynchronously.
• Make handling idempotent: senders retry, so the same delivery can arrive twice.
• Reject timestamps older than ~5 minutes to block replay attacks.
Local testing: ngrok http 3000 (free tier) exposes your handler, then resend from the provider dashboard and inspect the exact headers.No HTTP request is made - the tool only reads the pasted text, so the URL in a curl command is never contacted.
When to use it
- You copied a webhook body out of a provider dashboard and want to see what a handler has to work with before writing it.
- A receiver keeps rejecting deliveries and you want the signature-verification checklist in front of you.
- Reviewing a curl repro command a teammate pasted into a ticket.
What it does not do
- The name is misleading: it never connects to a URL. Use curl, a request bin or a tunnel such as ngrok when you actually need to deliver a payload.
- The list under the heading "Checks passed:" mixes findings with advice and ticks every line, so "No id/delivery_id - without one, receivers cannot de-duplicate a retried delivery." reads as a pass when it is a gap.
- Only JSON, curl commands and header blocks are recognised. A YAML-ish body such as "name: alice" is reported as a header block, and anything else comes back as "not valid JSON".
- The findings are keyword matches, so a body containing the words token, secret or card is flagged whether or not it really holds a credential.