Webhook signature

Input
Output

Webhook Signature Verifier

When a webhook fails its signature check, the cause is usually the body (re-encoded JSON, a changed line ending), the secret or the timestamp. Paste the exact body, the secret and the header you received to see whether it matches, or sign a body to test your own handler.

How do I use the Webhook signature?

  1. Pick the service and paste the body exactly as it was sent.
  2. Type the webhook's signing secret.
  3. To check a delivery, choose Verify and paste the header or signature you received; to test your handler, Sign and copy the header.

What does the Webhook signature do?

  • GitHub X-Hub-Signature-256 (sha256=…)
  • Stripe-Signature with its timestamp (t=…,v1=…), and the 5-minute replay window
  • Slack v0 signatures with X-Slack-Request-Timestamp
  • Shopify X-Shopify-Hmac-Sha256 (Base64)
  • Any HMAC-SHA256, SHA384, SHA512 or SHA1 in hex or Base64
  • Shows the exact text that was signed

Frequently asked questions

Is my secret sent anywhere?
No. The signature is computed with your browser's Web Crypto. The secret is kept only while the tab is open and is never saved, shared or added to history.
Why doesn't my signature match?
Most often the body isn't byte-for-byte what was sent: a framework parsed and re-encoded the JSON, or line endings changed. Sign the raw body, before any parsing.
Is my data uploaded?
No. Bracely runs entirely in your browser, so nothing you paste or open leaves your device.

More JSON tools

Bracely has more than 65 JSON tools in one page. Related ones:

Runs entirely in your browser. Nothing you paste is uploaded. Made by Saurabh Pagrut. About · Privacy policy
Last updated · Version 4.1 · Changelog
Saurabh Pagrut on GitHub · LinkedIn · X · YouTube · Instagram