Webhook Signature Tester
Verify webhook signatures for Stripe, GitHub, Shopify, Slack, and Twilio
Select Webhook Provider
Choose the webhook provider you want to verify signatures for
Stripe Webhook Verification
Stripe webhooks use HMAC-SHA256 with timestamp to prevent replay attacks
Signature Verification
Enter your webhook details to verify the signature
The secret key provided by Stripe
The raw webhook payload body (usually JSON)
Unix timestamp from the webhook request (e.g., 1614556800)
The signature from the Stripe-Signature header
Test Live Webhooks with HooksDash
Want to test real webhook signatures from Stripe? HooksDash provides instant webhook endpoints with automatic signature verification, request inspection, and local forwarding. Perfect for testing and debugging webhooks in development.
About Webhook Signature Verification
Webhook signatures are cryptographic signatures that verify the authenticity and integrity of webhook requests. When a webhook provider like Stripe, GitHub, or Shopify sends a webhook to your server, they include a signature in the request headers. This signature is computed using HMAC (Hash-based Message Authentication Code) with a secret key that only you and the provider know.
Why verify webhook signatures?
- Security: Ensures the webhook came from the legitimate provider, not a malicious third party
- Integrity: Confirms the payload hasn't been tampered with during transmission
- Replay Protection: Some providers (like Stripe) include timestamps to prevent replay attacks
How it works:
- The webhook provider computes an HMAC signature using your secret key and the payload
- They include this signature in a request header (e.g.,
X-Hub-Signature-256) - Your server receives the webhook and computes the same signature using your copy of the secret
- If the signatures match, the webhook is authentic; if not, reject it
This free online tool lets you test webhook signature verification without writing any code. All computations happen entirely in your browser using the Web Crypto API - your secrets and payloads never leave your device.
Supported providers:
- Stripe: Uses HMAC-SHA256 with timestamp (format:
t=timestamp,v1=signature) - GitHub: Uses HMAC-SHA256 (header:
X-Hub-Signature-256) - Shopify: Uses Base64-encoded HMAC-SHA256 (header:
X-Shopify-Hmac-SHA256) - Slack: Uses HMAC-SHA256 with version and timestamp (format:
v0=signature) - Twilio: Uses Base64-encoded HMAC-SHA1 (header:
X-Twilio-Signature)
Perfect for developers implementing webhook handlers, debugging signature verification issues, or learning how webhook authentication works. For testing live webhooks with automatic verification, check out HooksDash.
Need webhook testing?
HooksDash provides instant webhook endpoints, request inspection, and local forwarding. Perfect for testing the requests you build here.