Free developer tool
Webhook signature verifier
Check a GitHub, Stripe or Slack webhook signature locally with WebCrypto. Payloads and secrets stay in your browser.
1. Input
Choose the source, paste the exact raw body and signature header.
2. Result
HMAC-SHA256 is computed in this tab.
Waiting for input.
GitHub signs the raw body; Stripe signs timestamp.body; Slack signs v0:timestamp:body.
FAQ
Where does the signature secret come from?
The secret configured on the upstream webhook: GitHub's webhook Secret, Stripe's whsec_ signing secret, or Slack's signing secret.
Does the verifier send my secret anywhere?
No. HMAC-SHA256 is computed with the browser's WebCrypto API; the payload and secret stay in the tab and no request is made.
Why does verification fail for a valid signature?
Check the raw body bytes, the timestamp, and whether the header includes the expected prefix (sha256=, v1=, v0=). Whitespace or JSON re-serialization changes the signature.