Webhook Signature Analyzer

Runs in browser API Testing

Paste the payload, signature header and secret to recompute the expected signature using the provider's scheme (including timestamped Stripe/Slack formats) and see whether it matches. Nothing leaves your browser.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use Webhook Signature Analyzer

  1. Paste the raw request body exactly as received (no re-formatting).
  2. Choose the scheme, enter the secret and paste the signature header value.
  3. For Slack add the request timestamp; for Twilio add the full request URL.
  4. Press Verify: VALID/INVALID, expected vs provided signature, notes and a code snippet are shown.

Webhook Signature Analyzer features

  • Recomputes the expected signature locally with WebCrypto — secrets never leave the browser
  • Generic HMAC-SHA256/SHA1/SHA512 (hex/Base64), Stripe, GitHub, Shopify, Slack, Twilio, GitLab token and SHA-256(body+secret)
  • Timestamp tolerance checks for Stripe and Slack (replay protection)
  • Shows the exact signed payload and constant-time comparison result
  • Ready-to-use Node.js verification snippet for the chosen scheme

Webhook Signature Analyzer example

GitHub X-Hub-Signature-256

Input:

Body {"a":1} · Secret s · Signature sha256=37beaf650f70b40ec9706929c2e9d835cbd63729988f48781e6383a147215f07

Output:

VALID — the signature matches
Algorithm: HMAC-SHA256 (hex) with "sha256=" prefix
Expected: sha256=37beaf65…215f07

Frequently asked questions about Webhook Signature Analyzer

Which schemes are supported?

Generic HMAC-SHA256/SHA1/SHA512 in hex or Base64, Stripe (t=…,v1=… with timestamp tolerance), GitHub (sha256=…), Shopify (Base64), Slack (v0=… with X-Slack-Request-Timestamp), Twilio (URL + sorted params, Base64 SHA1), GitLab shared token and SHA-256 of body + secret.

Why does a valid webhook show INVALID?

Almost always because the body was re-serialised: pretty-printing, changed key order or trailing newlines alter the bytes. Paste the exact raw body your server received.

Is my secret safe?

Yes — the HMAC is computed with WebCrypto in your browser; the secret and payload never leave the page.

What is the timestamp tolerance?

For Stripe and Slack the signed timestamp must be within the tolerance (default 5 minutes) of now, otherwise a replayed delivery is rejected even if the HMAC matches.

Technical notes

Stripe signs "<t>.<body>" and lists v1 signatures in the header; Slack signs "v0:<timestamp>:<body>"; Twilio signs the full URL followed by the POST parameters sorted by name. Comparisons are constant-time to mirror production verification code.