Which regex flavour does the tester use?

JavaScript’s RegExp engine, which is ECMAScript-flavoured. It is close to PCRE for everyday patterns, but differs in a few places worth knowing: lookbehind support is newer, there are no possessive quantifiers or atomic groups, and named groups use the (? …) syntax. Patterns written for Python’s re or PHP’s preg_* usually port unchanged, but \A, \Z and \z have no direct equivalent.

Does my webhook secret leave the browser?

No. The HMAC signature is computed locally with the Web Crypto API and only the resulting signature header is sent, to the endpoint you specify. The secret itself is never transmitted and is discarded when you reload the page.

Why does the webhook tester report a CORS error?

The request is sent from your browser, so it is subject to the same-origin policy. An endpoint that does not return permissive CORS headers will block the response even though your server received the request — check your server logs to confirm it arrived. For endpoints you cannot add CORS headers to, send the same request from a terminal with curl instead.

Why does the diff show a change when the two sides look the same?

Almost always invisible characters. The usual suspects are trailing whitespace, CRLF versus LF line endings, a tab where a run of spaces is expected, or a non-breaking space that was pasted from a document or a browser.

Developer Tools — Regex, Diff & Webhook Testing

The debugging tools you reach for when something almost works: a regex tester, a diff, a pattern generator, and a webhook inspector.

4 tools · Reviewed by Mimamsa, Founder & Engineer, CodeLint.Dev

These four have one thing in common — each answers a question you cannot answer by reading code. Does this pattern actually match that input? What exactly changed between these two files? What is the payload that service is really sending?

The regex tester highlights matches live as you type, names your capture groups, and explains each token of the pattern, which turns a write-run-guess loop into something you can reason about. The generator works in the other direction, taking a plain-English description and producing a pattern you can then check in the tester.

The diff checker compares at word level rather than line level, so a reflowed paragraph or a reordered import does not show up as a wholesale rewrite. The webhook tester fires a request at your own endpoint — realistic GitHub, Stripe or Slack payloads, custom headers, and an HMAC signature computed from your secret — then shows you the status, headers, body and latency that came back. It is how you find out your handler rejects a valid signature before a provider does.

Pattern matching

Regex Tester Live match highlighting, capture group inspection, and a token-by-token explanation of the pattern. Supports the standard JavaScript flags.Regex Generator Describe what you want to match in plain English and get a working pattern back, with each part explained so you can adjust it.

Comparison & inspection

Diff Checker Word-level comparison of two texts with additions and deletions highlighted inline. Handles reflowed text without reporting the whole paragraph as changed.Webhook Tester Send a crafted request to your own webhook endpoint — provider payload templates, custom headers, HMAC signing — and inspect the response.

Which tool for which problem

Symptom	Tool
A regex matches in one language but not another	Regex Tester — check flag and escaping differences
You know what to match but not how to write it	Regex Generator, then verify in the Tester
Two files look identical but compare unequal	Diff Checker — usually trailing whitespace or line endings
You need to test a handler without waiting for a real event	Webhook Tester — replay a realistic payload on demand
A signature check rejects requests you believe are valid	Webhook Tester — sign with your secret and compare

In-depth guides

Long-form articles covering the standards and formulas behind these tools.

Frequently asked questions

Which regex flavour does the tester use?: JavaScript’s RegExp engine, which is ECMAScript-flavoured. It is close to PCRE for everyday patterns, but differs in a few places worth knowing: lookbehind support is newer, there are no possessive quantifiers or atomic groups, and named groups use the (?<name>…) syntax. Patterns written for Python’s re or PHP’s preg_* usually port unchanged, but \A, \Z and \z have no direct equivalent.
Does my webhook secret leave the browser?: No. The HMAC signature is computed locally with the Web Crypto API and only the resulting signature header is sent, to the endpoint you specify. The secret itself is never transmitted and is discarded when you reload the page.
Why does the webhook tester report a CORS error?: The request is sent from your browser, so it is subject to the same-origin policy. An endpoint that does not return permissive CORS headers will block the response even though your server received the request — check your server logs to confirm it arrived. For endpoints you cannot add CORS headers to, send the same request from a terminal with curl instead.
Why does the diff show a change when the two sides look the same?: Almost always invisible characters. The usual suspects are trailing whitespace, CRLF versus LF line endings, a tab where a run of spaces is expected, or a non-breaking space that was pasted from a document or a browser.

Other tool categories

JSON Tools Three JSON tools that cover the whole round trip — make it readable, make it small, make it safe to embed in a string.Encoders & Decoders Five encoders that turn data between representations — and, for JWTs especially, let you see what is actually inside.Network & Security Four tools for the questions that come up when something works locally and fails in production.Generators & Utilities Generators and converters for the values you need constantly and should never have to fetch from a server.