Paste-only • Client-side verification
Webhook Signature Verifier
Compare exact bytes without uploading secrets
Verify Generic HMAC, GitHub X-Hub-Signature-256, or Stripe Stripe-Signature values using the exact raw request body.
Payloads, signatures, and secrets stay in this browser tab. They are not fetched, uploaded, stored, logged, or included in analytics events.
Whitespace, line endings, encoding, and key order change the signed bytes. Do not reformat JSON before verification.
Boundaries that still matter in production
- Verify before parsing. Capture the exact raw bytes before middleware changes the body.
- Use official provider libraries. This page is a debugging aid, not receiver middleware.
- Handle replay separately. Enforce timestamp tolerance where defined and deduplicate provider delivery or event IDs.
- Protect the secret. A match is meaningful only if the configured signing secret is controlled by the expected parties.