Webhook Signature Verifier
Verify and generate Stripe, GitHub, and Slack HMAC webhook signatures via Web Crypto. Timestamp tolerance checks, expected-vs-received digests, zero upload.
Loading tool...
What is Webhook Signature Verifier?
The Webhook Signature Verifier recomputes HMAC-SHA256 signatures for Stripe, GitHub, and Slack webhook schemes entirely in your browser. Paste the raw payload, your signing secret, and the received header to see a valid, stale, or invalid verdict with expected-vs-received digest details - or switch to generate mode to produce a valid signature header for testing.
Key Benefits
- Confirm webhook authenticity before trusting a payload
- Replay protection via timestamp tolerance checks
- Expected-vs-received digests pinpoint mismatches instantly
- Generate test headers without writing crypto code
- Signing secrets never leave your browser
Common Use Cases
- •Debugging endpoints that reject valid-looking Stripe webhooks
- •Validating GitHub webhook deliveries in local tunnels
- •Checking Slack slash-command signatures
- •Testing your own HMAC verification code with known-good headers
- •Security review of incoming webhook handlers
How to Verify a Webhook Signature
- Pick the provider scheme: Choose Stripe, GitHub, or Slack - each signs payloads with a slightly different base string.
- Paste the raw payload and secret: Copy the exact raw request body (not re-serialized JSON) and your endpoint signing secret.
- Verify the header: Paste the signature header and click Verify - the tool recomputes the HMAC and compares digests, including timestamp tolerance.
- Generate for tests: Switch to generate mode with a known timestamp to produce a valid header for local webhook testing.
Key Features
- Stripe t=/v1=, GitHub sha256=, and Slack v0= signature schemes
- HMAC-SHA256 computed with native Web Crypto
- Timestamp age check with configurable tolerance window
- Expected vs received digest comparison for debugging
- Generate mode produces valid headers for endpoint tests
- Secrets stay in your browser - no network requests