Free tool

Webhook signature verifier

Paste a webhook's body, its signing secret and its signature header to see whether they match. Works for Standard Webhooks, Stripe, GitHub, Shopify, Slack and Railhook.

Runs entirely in your browser. Your secret and payload never leave this page.

Webhook signature verifier

Provider

whsec_ followed by base64. The part after whsec_ is decoded and used as the key.

Headers

Paste the value, or the whole line with the header name.

Paste the body exactly as it arrived. Reformatting JSON, even its whitespace, changes the signature.

Fill in the body, the secret and every header to check the signature.

How each provider signs

What is signed, with which key, and where the signature goes. Every scheme here is HMAC-SHA256.

Standard Webhooks
Signs webhook-id.webhook-timestamp.body with the base64-decoded whsec_ secret. The webhook-signature header carries v1,<base64>, one entry per active secret. The timestamp is in seconds, with a 5-minute window.
Stripe
Signs t.body with the whsec_ secret as written. Stripe-Signature carries t=<seconds>,v1=<hex>, one v1 per active secret, with a 5-minute window.
GitHub
Signs the raw body. X-Hub-Signature-256 carries sha256=<hex>. There is no timestamp.
Shopify
Signs the raw body. X-Shopify-Hmac-Sha256 carries the digest in base64. There is no timestamp.
Slack
Signs v0:timestamp:body. X-Slack-Signature carries v0=<hex>, and X-Slack-Request-Timestamp the time in seconds, with a 5-minute window.
Railhook
Signs t.body with the endpoint secret. X-Signature carries t=<milliseconds>,v1=<hex>, with a 5-minute window. Railhook sends the Standard Webhooks headers as well.

Railhook checks these for you on every incoming webhook

Point Stripe, GitHub, Shopify, Slack, GitLab or Twilio at a Railhook source. Every request is verified with the provider's own scheme before it is stored, and a forged one is refused.

Start freeHow verification works