Webhook Signature Verifier
Verify a webhook signature from GitHub, Stripe, Slack, Shopify or any HMAC-based provider, or compute the signature for a test payload.
Frequently Asked Questions
How do I verify a webhook signature?
Pick the provider, paste the exact raw request body you received, enter your webhook secret, then paste the signature header value (and timestamp header, for Slack). The tool recomputes the signature and tells you whether it matches.
Why does the signature not match even though the secret is correct?
The signature almost always covers the raw, unmodified request body. If a framework parses the JSON before your handler runs and you re-serialize it to check the signature, whitespace or key order can change and break the match. Paste the body exactly as received, not a re-formatted version.
How does Stripe sign webhooks?
Stripe sends a Stripe-Signature header containing a timestamp and one or more signatures, like "t=169...,v1=abc...". It signs the string "{timestamp}.{body}" with HMAC-SHA256 using your webhook signing secret. Stripe also recommends rejecting timestamps older than 5 minutes to prevent replay attacks.
How does Slack sign requests?
Slack sends the timestamp in a separate X-Slack-Request-Timestamp header, and signs "v0:{timestamp}:{body}" with HMAC-SHA256 using your app's Signing Secret, sent as X-Slack-Signature.
Why is the Shopify signature in a different format?
Shopify sends X-Shopify-Hmac-SHA256 as Base64 rather than hex, unlike GitHub, Slack and Stripe. The tool reads either automatically.
Can I use this to generate a signature instead of checking one?
Yes. Enter the body and secret, then click "Compute expected signature" to fill in the header value your server should send or expect — handy for building test fixtures.
Is my secret sent anywhere?
No. Verification runs entirely in your browser using the Web Crypto API. Even so, use test secrets rather than real production ones in any web page.