Tool

Webhook signature generator and verifier (GitHub, Stripe, Slack, Meta)

Use it to send correctly signed test deliveries to your local endpoint, or to debug why your verification fails. Secrets never leave the page and are not saved.

Provider

Secret

Algorithm

Encoding

Timestamp (Unix seconds)

webhook-id

Raw body (exact bytes)

Received signature to verify (optional)

Test endpoint for curl

String that is signed

Signature

Headers

Signed test request

Verification code (Node.js)

Why verification usually fails

The body was parsed and re-serialized before hashing. Hash the raw bytes exactly as received.
Wrong secret: test mode and live mode, or the app secret versus the verify token.
Comparing with == instead of a constant-time comparison, or comparing hex against base64.
For timestamped schemes, a clock skew or a replayed request older than five minutes.

Discord interactions use Ed25519 public-key signatures rather than HMAC; verify them with your application's public key.