🔏 Webhook Signature Verifier

Stripe · GitHub · Slack · generic HMAC — verify a webhook payload against its signature

Found in your webhook endpoint settings dashboard.
Copy the exact header value from the incoming request.

How each provider signs

What is Webhook Signature Verifier?

Webhook Signature Verifier checks whether a webhook payload actually came from the provider it claims to (Stripe, GitHub, Slack) by recomputing the HMAC signature with your signing secret and comparing it to the signature header the provider sent. Everything — hashing, comparison, timestamp checks — runs locally with the WebCrypto API; your secret and payload never leave the browser.

Webhook signature verification is essential because webhook endpoints are public URLs — anyone who finds the URL can POST fake events unless you verify the sender. Each provider signs the raw request body with a shared secret using HMAC (Hash-based Message Authentication Code), so only someone who knows the secret can produce a matching signature. This tool lets you test your verification logic against real captured payloads before deploying it.

How to Use

  1. Select the provider (Stripe, GitHub, Slack, or Generic HMAC).
  2. Paste the exact raw request body you received — do not reformat or re-indent JSON, since signatures are computed over the exact bytes.
  3. Enter your webhook signing secret from the provider's dashboard.
  4. Paste the signature header value exactly as received (e.g. the full Stripe-Signature or X-Hub-Signature-256 header).
  5. Click Verify Signature to see whether it matches, plus the computed digest for debugging.

Features

Frequently Asked Questions

Why does my signature never match even though I'm using the right secret?

Almost always because the payload was re-serialized (re-parsed and re-stringified JSON changes whitespace and key order, which changes the bytes being signed). Always verify against the raw request body, not a parsed-then-reserialized copy.

Why check the timestamp as well as the signature?

A valid signature only proves the payload wasn't tampered with — it doesn't prove the request is fresh. Without a timestamp/replay check, an attacker who intercepts one valid request could resend it indefinitely.

Is it safe to paste my real webhook secret here?

This tool never makes a network request — everything runs with the browser's built-in WebCrypto API. That said, for a production secret it's still good practice to rotate it afterward if you have any doubt about your machine's security.

Related Tools