About this tool
Every serious webhook provider — Meta, Shopify, Stripe, Slack — signs each delivery with an HMAC so your endpoint can prove the payload really came from them and was not tampered with in transit. Debugging those signatures is painful: each platform uses a different header, a different encoding and a different way of mixing timestamps into the signed payload. Webhook Signature Validator puts all four presets in one place. Pick a provider, paste your signing secret and the raw request body, and the tool computes the expected signature locally with the Web Crypto API: sha256-prefixed hex for Meta's X-Hub-Signature-256, base64 for Shopify's X-Shopify-Hmac-Sha256, the timestamp-plus-v1 scheme for Stripe, and Slack's v0 format built from the timestamp and body. Paste the signature you actually received and the tool compares it character by character, so a mismatch is obvious instantly. Because the HMAC runs entirely in your browser via crypto.subtle, your webhook secrets never leave your machine — you can safely debug production secrets that you would never paste into a random website. It is the fastest way to answer the eternal webhook question: is my verification code broken, or is this signature genuinely wrong?
How to use Webhook Signature Validator
- Pick the platform preset that sent the webhook: Meta, Shopify, Stripe, Slack or a generic HMAC-SHA256.
- Paste your signing secret and the raw, unmodified request body. For Stripe and Slack also paste the timestamp header.
- Read the computed signature, or copy it for use in tests.
- Paste the signature header you actually received to get an instant match or mismatch verdict.
Frequently asked questions
Is my signing secret safe to paste here?
Yes. The HMAC is computed in your browser with the Web Crypto API (crypto.subtle). Nothing is transmitted, logged or stored.
Why must the payload be the raw body?
Providers sign the exact bytes they sent. Re-serializing parsed JSON changes whitespace and key order, which changes the signature even when the data is identical.
What does Stripe's t= timestamp do?
Stripe signs the string timestamp-dot-payload, so the timestamp is part of the signed content. It also lets you reject old replays; the v1 value in the header is compared against the computed signature.
The signature does not match — what now?
Check that you used the raw body, the correct secret for that endpoint, and the right encoding (Meta and Slack use hex, Shopify uses base64). A mismatch here means your verification code or the request itself is the problem.