Free tool

Webhook signature verifier

Paste a webhook's body, signing secret and signature header to check whether they match. Standard Webhooks, Stripe, GitHub, Shopify, Slack and Railhook.

Runs in your browser. The secret and payload never leave this page.

Webhook signature verifier

Provider

whsec_ followed by base64. The part after whsec_ is decoded and used as the key.

Headers

Paste the value, or the whole line with the header name.

Paste the body exactly as it arrived. Reformatting JSON, even its whitespace, changes the signature.

Fill in the body, the secret and every header to check the signature.

How each provider signs

What is signed, with which key, and where the signature goes. Every scheme here is HMAC-SHA256.

Standard Webhooks
Signs webhook-id.webhook-timestamp.body with the base64-decoded whsec_ secret. The webhook-signature header carries v1,<base64>, one entry per active secret. The timestamp is in seconds, with a 5-minute window.
Stripe
Signs t.body with the whsec_ secret as written. Stripe-Signature carries t=<seconds>,v1=<hex>, one v1 per active secret, with a 5-minute window.
GitHub
Signs the raw body. X-Hub-Signature-256 carries sha256=<hex>. There is no timestamp.
Shopify
Signs the raw body. X-Shopify-Hmac-Sha256 carries the digest in base64. There is no timestamp.
Slack
Signs v0:timestamp:body. X-Slack-Signature carries v0=<hex>, and X-Slack-Request-Timestamp the time in seconds, with a 5-minute window.
Railhook
Signs t.body with the endpoint secret. X-Signature carries t=<milliseconds>,v1=<hex>, with a 5-minute window. Railhook sends the Standard Webhooks headers as well.

Railhook verifies these on every incoming webhook

Point Stripe, GitHub, GitLab, Shopify, Slack, Twilio, Square, Adyen, SendGrid or HubSpot at a Railhook source. Each request is checked with the provider's scheme before it is stored; a forged one is refused.

Start freeHow verification works