Webhook signature debugger

Paste a secret, the raw body, and the signature header you received — see whether they match, and exactly what was signed. Supports GitHub, Stripe, Shopify, Slack, Zoom, Svix (Clerk, Resend), Twitch EventSub, Square, HubSpot, Mailgun, Twilio, WooCommerce, generic HMAC.

🔒 Nothing leaves your browser. All computation uses the WebCrypto API on this page — the secret and body are never sent anywhere (open devtools → Network and verify: zero requests after page load). Most "online HMAC calculators" post your production secret to their server. This one can't.

Provider / scheme
Secret

HTTP method

Webhook URL

Message ID

Timestamp

Token

Form parameters (name=value per line)

Raw request body (byte-exact — copy from a capture, not from a pretty-printer)

Received signature

Where do I get the byte-exact raw body?

Signature verification fails the moment a single byte differs — and most frameworks hand you a parsed body, not the raw one. The reliable way: point the webhook at a Hookden capture bin for one delivery. The bin stores the body byte-exact, shows every header, and can verify these signatures automatically on arrival (set the scheme + secret in bin settings, get a ✓/✗ badge on each capture). Then copy the raw body and header values into this page to test your own verification code against the same bytes.

Supported schemes

Body-only HMAC (GitHub, Shopify, WooCommerce, generic) · timestamp-prefixed (Stripe, Slack, Zoom) · ID+timestamp (Svix/Standard Webhooks, Twitch EventSub) · URL-signing (Square, HubSpot v3, Twilio) · body-embedded (Mailgun). Each has a full troubleshooting guide — pick your provider above and follow the guide link. Discord's Ed25519 interaction signing is intentionally absent: it can't be usefully checked offline (Discord requires a live endpoint that rejects invalid probes — see the Discord guide).

← All guides · Docs · Create a capture bin