Web Tools tools.bryantsmith.com

Creative Workflow Helpers

Webhook Signature Verifier

Confirm that a webhook really came from your provider. Paste the raw body, the signing secret and the signature header to check the HMAC instantly — everything stays in your browser.

Runs in your browser v1.0.0

Request details

private

Presets pick the right algorithm, format and signed content automatically.

Used as UTF-8 bytes exactly as typed. It is never sent anywhere.

Paste the header value as received, for example sha256=….

Signed exactly as received — do not reformat or re-serialize JSON.

Advanced: algorithm & signature format

Only needed for custom or generic HMAC webhooks.

Verification result

Waiting
Enter a secret and signature header to verify.
Expected signature
—
Provided signature
—
Algorithm & format
—
Signed content
—
Timestamp
—

How it works

A webhook provider signs the raw request body with your shared secret using HMAC and sends the result in a header. This tool rebuilds that HMAC with the hash the provider uses and compares it to the header: GitHub uses sha256=<hex>, Shopify sends Base64, Slack signs v0:timestamp:body and Stripe signs timestamp.body. For Stripe and Slack the timestamp freshness is checked against a 5 minute tolerance. Everything is computed locally — your secret and payload are never uploaded.

Related tools

  • .env Compare & MergeCompare development, staging, and production .env key sets without exposing secret values, then build a merged template.
  • Accessible Name CalculatorPaste HTML, pick an element, and see the accessible name assistive technology computes — entirely in your browser.
  • Apache Rewrite TesterTest Apache mod_rewrite rules against a sample request path and see the rewritten URL, redirects, captures and warnings.
  • Cookie Builder & InspectorBuild a Set-Cookie header or paste one to inspect its expiry, path, domain, Secure, HttpOnly and SameSite attributes — entirely in your browser.
  • CORS Header Builder & ExplainerModel a cross-origin request and get the exact CORS response headers to send, explained in plain language.
  • CSP AnalyzerPaste a Content-Security-Policy to flag risky, redundant, contradictory, and commonly misunderstood directives — entirely in your browser.

More Creative Workflow Helpers tools