Free tools / Signature Checker

Signature Checker

Paste the raw body, the signature header and your secret. See whether it verifies, or what header you should be sending. Everything stays in your browser.

Result

Fill in the form and press Check.

How each provider signs

Stripe sends Stripe-Signature: t=<unix time>,v1=<hex>. The signature is HMAC-SHA256 of <t>.<raw body> with the endpoint secret (whsec_…) used as the key as-is. Reject if t is older than a few minutes.

GitHub sends X-Hub-Signature-256: sha256=<hex>: HMAC-SHA256 of the raw body with the webhook secret.

Shopify sends X-Shopify-Hmac-Sha256: <base64>: HMAC-SHA256 of the raw body with the app's client secret.

Standard Webhooks sends webhook-id, webhook-timestamp and webhook-signature: v1,<base64>. The key is the secret after whsec_, base64-decoded; the signed string is <id>.<timestamp>.<raw body>.

Common causes of a mismatch: the body was re-serialised by a framework before checking (whitespace or key order changed), the secret has a trailing newline, or a proxy altered the encoding.