Webhook Signature Verifier
Paste a webhook body, shared secret, and signature header to verify HMAC-SHA256 signatures or generate a matching header for local tests. Normalizes common sha256=, v1=, and hex header formats, builds a copyable verification checklist, exports a Node verification snippet, and generates a safe verification test pack with env placeholders and payload hash checks. Everything runs in your browser.
Runs in your browser
Nothing uploaded
Free, no signup
Ctrl + Enter to run · Recent brings back your last inputs · Everything stays in this browser
Webhook Signature Verifier: questions
What signature format does it support?
It verifies HMAC-SHA256 signatures in common formats such as sha256=<hex>, v1=<hex>, and bare hex digests.
Does my webhook secret leave the browser?
No. The verifier uses the browser Web Crypto API locally and does not send the secret, payload, or signature to HTMLToolz.
What is in the verification test pack?
The pack includes .env.example placeholders, reviewed raw-body and signed-payload SHA-256 checks, and a Node verifier that reads webhook-body.txt locally. It intentionally omits the shared secret and raw webhook body.
Can it verify Stripe or Slack signatures completely?
Use this for the HMAC comparison and local test fixtures. Some providers include timestamp or signed-base-string rules that you should confirm against their official docs before production enforcement.
What is the Node snippet for?
It gives developers a reviewed starting point for constant-time HMAC verification in a backend route or CI smoke test.
Related tools
All 112 free tools
JSON Formatter & ValidatorPretty-print & validate JSON
Image Resize CalculatorCalculate new dimensions while preserving aspect ratio
Password Strength CheckerAnalyze password entropy and weaknesses
YAML ↔ JSON ConverterConvert between YAML and JSON
JSON to YAMLConvert JSON to YAML format
JSON Schema GeneratorInfer and validate API contracts
Made something with AI? Share it as a private link.
Drop in the HTML from Claude, ChatGPT or any editor and get a link your client can open anywhere — with a password, view tracking, comments and approval.