Verify a webhook signature
Pick a provider, paste the payload, the signature header, and your signing secret — this checks it against the real verification code webhook.co runs for 124 providers. Every byte stays in your browser: nothing you paste is sent anywhere or saved.
How it works: your inputs are assembled into the exact bytes the provider signs, and the signature is recomputed with Web Crypto and compared in constant time — the same audited engine that verifies every event on webhook.co. Providers whose key is fetched from their own servers can't be checked in a browser and are left out.
Webhook signature verification: common questions
Why doesn't my webhook signature match?
Almost always because the bytes you verified aren't the bytes the sender signed. A web framework that parses the JSON body and hands you an object has already re-serialised it — different whitespace, different key order — so the hash no longer lines up. Verify against the raw request body, exactly as it arrived, before anything touches it.
Do I hash the raw body or the parsed JSON?
The raw body. A signature is computed over the exact bytes that were sent, so re-serialising after JSON.parse reorders keys and drops whitespace, and any of that changes the hash. Capture the raw bytes first, verify, then parse.
The secret looks right and it still fails — what else?
Check the timestamp. The Standard Webhooks scheme and several providers fold a timestamp into the signed value and reject anything outside a tolerance window, so a clock that has drifted, or a request you're replaying long after it was sent, fails even with the correct secret.
Am I using the right signing secret?
Each endpoint has its own secret, and they are easy to cross. A secret copied from a different endpoint — or a local CLI's secret used against a dashboard-registered endpoint — verifies cleanly against the wrong payload and fails against yours. Confirm the secret belongs to the endpoint that received this exact request.
Does anything I paste here leave my browser?
No. The payload, the signature and the secret are all processed in the page with Web Crypto and are never sent anywhere or stored. You can check a production secret here without it leaving your machine.