Skip to content
Webmaster Tools
Inspect & debugWebhook Signature Verifier

Webhook Signature Verifier

Stripe, GitHub, Slack, Shopify and other HMAC signatures.

The secret stays in this browser tab: it isn't sent to our server or saved.
Paste the value, or all the request headers at once (one Name: value per line) and the provider is picked for you.
Use the bytes your server received, before any JSON parsing. Whitespace and the trailing newline count.

Result

About the Webhook Signature Verifier

Webhook providers sign each request with a shared secret so your endpoint can prove it came from them and wasn't changed. This tool recomputes the HMAC in your browser with Web Crypto and compares it with the signature header. The secret and body never leave the page.

Presets cover the common schemes:

  • Stripe: Stripe-Signature: t=…,v1=…, HMAC-SHA256 hex of timestamp.body, with a timestamp tolerance (300 seconds by default).
  • GitHub: X-Hub-Signature-256: sha256=…, HMAC-SHA256 hex of the body (legacy sha1= too).
  • Shopify: X-Shopify-Hmac-Sha256, base64 HMAC-SHA256 of the body.
  • Slack: X-Slack-Signature: v0=… over v0:timestamp:body.
  • Twilio: X-Twilio-Signature, base64 HMAC-SHA1 of the full URL followed by the POST parameters sorted by name. JSON requests sign the URL and carry a bodySHA256 parameter, which is checked too.
  • Standard Webhooks (Svix, Resend, Clerk and others): webhook-signature: v1,… over id.timestamp.body with a whsec_ secret.
  • Generic HMAC: SHA-1, SHA-256 or SHA-512, hex or base64, an optional prefix and an optional timestamp-plus-separator scheme.

When a signature doesn't match, the tool retries the usual mistakes (a trailing newline, other line endings, minified or pretty-printed JSON, spaces around the secret) and tells you if one of them verifies.

How to use it

  1. Choose the provider, or paste all the request headers and let it pick.
  2. Enter the signing secret.
  3. Paste the raw body exactly as received, before any JSON parsing.

From the Webhook Inspector, select Verify signature on a captured request to load its body and headers here. They are handed over in this tab's session storage, never in the URL, and the timestamp is checked against when the request arrived.

Examples

  • Capture a test event in the Webhook Inspector, then select Verify signature and add your secret.

Common questions

Why does my signature check fail in code but pass here?

Most frameworks parse JSON before your handler runs. Re-serializing it changes spacing and key order, so verify against the raw bytes.

Why is a valid signature rejected as too old?

Timestamped schemes refuse old requests to stop replays. Check the server clock, or that you aren't replaying a stored event.