Webhook HMAC Signer
Sign and verify GitHub, Stripe, and Slack webhook signatures locally.
OpenCheck a run of webhook deliveries for replays and drift before your handler processes them twice.
Use a JSON array or one JSON payload per line.
Point at the idempotency field, such as id or data.object.id.
Compute a SHA-256 HMAC for each event.
Review duplicate keys, body changes and digests.
After a provider outage, your queue receives a burst of retries and a customer is charged twice. To understand what happened, you export the deliveries from your logs and need to know which events share an id and whether any retried body changed along the way.
Paste events as a JSON array or as NDJSON with one payload per line, set the idempotency claim path, and press Analyse timeline. The path uses dot notation, so id works for flat events and data.object.id reaches into Stripe-style nesting. The report is JSON: the event count, every duplicate key with the index of its first appearance and of the replay, and a list of neighboring pairs whose bodies differ, with both lengths so you can tell whether a field was added or a value merely changed.
Add an HMAC secret and each event also gets a SHA-256 digest, with repeated digests pointing back to the first identical event. The digest is calculated over each event re-serialized as compact JSON, not over the original bytes a provider signed, so these values will not match the signature headers in your logs; use them to spot identical payloads. To check a real signature against a raw body, switch to the webhook HMAC signer. Body comparison only looks at consecutive events, so for a full diff of two specific payloads, paste them into JSON Compare.
Events and the optional secret are handled with Web Crypto inside this tab, and the report downloads as webhook-replay-report.json.
Keyboard shortcut
Answers for this tool. For site-wide help, open the FAQ hub.
They are computed over each event after it has been parsed and re-serialized, without any timestamp prefix a provider adds. Use them to compare events with each other, not to verify deliveries.
Two events with the same value at the idempotency path. Events where the path is missing or empty are skipped, so check the path if you expected duplicates and the report shows none.
No. Every NDJSON line must be valid JSON on its own. Strip timestamps and log prefixes first, or collect the payloads into a JSON array.