Webhook Signature Checker
Paste a webhook’s headers and body to see the provider and event and check its signature with your secret — GitHub, Stripe, Razorpay, Slack, Shopify, Standard Webhooks, GitLab or any HMAC. The secret stays on this page.
Webhook Signature Checker
Check a webhook’s signature
Paste a delivery’s headers and raw body — from your server’s log or the provider’s delivery page — and the secret. The signature is checked here with the browser’s own crypto.
GitHub · Stripe · Razorpay · Slack · Shopify · Standard Webhooks / Svix · GitLab · any HMAC
How is this calculated?
Each provider’s scheme is its own documentation’s: GitHub, Razorpay and Shopify sign the body (hex, hex and base64); Stripe signs "timestamp.body"; Slack signs "v0:timestamp:body"; Standard Webhooks sign "id.timestamp.body" with the base64 key after whsec_. Comparisons look at every character so their timing does not reveal where a mismatch starts — the same rule your server should follow. Signed timestamps more than five minutes from now are flagged, because a server checking freshness would refuse them as replays. GitHub’s published example (secret "It's a Secret to Everybody", body "Hello, World!") is in the tests, and every scheme is cross-checked against Node’s own HMAC.Runs in your browser — nothing you enter leaves this device.
About this tool
What it does
Checks a webhook the way your server should before trusting it. Paste the request headers and the raw body; the provider is recognised from its signature header, the event and delivery id are pulled out, and — with the secret — the signature is recomputed and compared. GitHub (X-Hub-Signature-256), Stripe (Stripe-Signature, with its timestamp), Razorpay (X-Razorpay-Signature), Slack (X-Slack-Signature with the request timestamp), Shopify (X-Shopify-Hmac-Sha256, base64), Standard Webhooks and Svix (webhook-id, -timestamp and -signature, several signatures allowed), GitLab (X-Gitlab-Token, a shared token rather than a signature), and any other provider that signs the body with HMAC-SHA1, SHA-256 or SHA-512 in hex or base64. The payload is shown formatted, or as form fields for Slack-style bodies.
How to use it
- Copy one delivery’s request headers and raw body — from your server’s log, or the provider’s “recent deliveries” page.
- Paste them, and enter the webhook’s secret (for Stripe, the endpoint’s whsec_… secret; for Razorpay, the webhook secret, not the API key secret).
- Read the verdict. If it does not match, compare “Received” with “Computed”, and open “The exact text that was signed” to see what was hashed.
Limits and your data
- The signature covers the exact bytes sent. A body that was re-formatted, re-encoded or copied with different line endings will not match even with the right secret — paste it from a raw log, not from a pretty-printed view.
- Schemes that sign the URL as well as the body (Twilio, for example) are not covered.
- A valid signature proves who sent the request, not that it is new: your server should also reject old timestamps and repeated delivery ids.
- The signature is computed in your browser with the Web Crypto API. The secret, headers and body are never sent anywhere or saved; the page works offline. Even so, treat a production secret with care — use a test endpoint’s secret when you can.
Questions
The secret is right but the signature does not match. Why?
Almost always the body. Frameworks often parse JSON and hand you an object; serialising it again changes spacing and key order. Verify against the raw request body before parsing it.
Why does Stripe’s header have several v1 values?
While you roll an endpoint secret, Stripe signs with both the old and new one. Accept the request if any v1 signature matches.
Is GitLab’s token a signature?
No. GitLab sends the secret itself in X-Gitlab-Token, so anyone who sees one request can reuse it. Keep the endpoint on HTTPS and compare the token in constant time.
Which secret does Razorpay use?
The secret you set on the webhook in the Dashboard. It is different from the API key secret, which signs payment responses instead.