Webhook Signature Verifier
Verify GitHub, Stripe, Slack, Shopify and Standard Webhooks signatures and see why they fail
Input
Kept in memory only. Never saved, logged or sent.
One "Name: value" per line, or a JSON object. Names are case-insensitive.
Required headers
X-Hub-Signature-256Missing
Text boxes turn CRLF line breaks into LF. When exact bytes matter, paste the body as Hex or Base64, or load it from a file.
Paste raw HTTP request
Request line, headers, a blank line, then the body.
Results
Details
What the verifier checks
Paste a webhook delivery (signing secret, headers and exact raw body) to recompute its signature with the provider’s own rules: GitHub X-Hub-Signature-256, Slack v0 signatures over the request timestamp, Shopify Base64 HMAC, Stripe t= and v1= signatures (any v1 may match during secret rotation), Standard Webhooks and Svix webhook-id, webhook-timestamp and webhook-signature, and a configurable generic HMAC. Signature validity and timestamp freshness are reported separately.
Why verification fails
Signatures cover exact bytes. When a signature does not match, the verifier retries with common mistakes and names the first one that matches: an added or missing trailing newline, CRLF or LF conversion, JSON that was parsed and re-serialized, whitespace around the secret, a whsec_ secret used without Base64 decoding, or another provider’s scheme. Missing headers, malformed signatures and old or future timestamps each get their own finding.
Exact bytes
Verification always uses the raw body; Pretty preview is display only. Text boxes convert CRLF line breaks to LF, so paste the body as Hex or Base64 or load it from a file when the exact bytes matter. Bodies up to 5 MB and secrets up to 64 KB are accepted.
Privacy and limits
Everything runs in your browser with Web Crypto. The secret is kept in memory only and is never saved, put in the URL, logged or sent; only the provider and tolerance are remembered. The tool does not replay requests or contact providers, and it does not verify asymmetric signatures such as Standard Webhooks v1a (Ed25519).
