Webhook Signature Verifier
Verify GitHub, Stripe, and Slack-style HMAC webhook signatures using your browser and Web Crypto.
Verify HMAC webhook signatures locally
Webhook providers prove authenticity with HMAC signatures over the raw request body (and
sometimes a timestamp). GitHub sends X-Hub-Signature-256, Stripe uses
Stripe-Signature with t= and v1= fields, and Slack
signs v0:timestamp:body with your signing secret. Paste the payload and header
values to confirm they match before you trust an event in production.
What gets hashed
- GitHub, HMAC-SHA256 of the raw body, prefixed with
sha256=in the header. - Stripe, HMAC-SHA256 of
{timestamp}.{body}; compare against thev1signature. - Slack, HMAC-SHA256 of
v0:{timestamp}:{body}; compare againstv0=inX-Slack-Signature.
Decode JWT access tokens with the JWT Decoder after you validate the webhook envelope.
Frequently Asked Questions
Are secrets uploaded?
No. Web Crypto computes HMAC entirely in your browser. Clear the page on shared machines.
Why does my GitHub signature fail?
Ensure you hash the raw bytes GitHub posted, not pretty-printed JSON. Copy the exact body from your proxy or logs.
Can I verify other algorithms?
Use the generic mode for plain HMAC-SHA256 hex comparisons when your provider documents that format.
Related Tools
Pendulum Frequency Calculator
Linear Actuator Force Calculator
YAML Beautifier
DPI PPI Size Converter
Data URI Generator
Antipode Calculator
VA Disability
Impermanent Loss Calculator
Date Range Splitter
Rice Water Ratio Calculator
Fixed Width To Csv
SPF Generator
Vicsek Curve Generator
Steps to Miles
TSV to XLSX Converter
F Statistic Calculator
JSONC to JSON Converter
Risk Reward Ratio Calculator
Nickname Generator
Magic 8 Ball