Browser-only developer tool

GitHub Webhook Signature Verifier

Secrets and payloads never leave your browser. Verification uses Web Crypto locally. Inputs are not saved in URLs or browser storage. No analytics runs on these tool pages.

Nothing is trimmed, parsed as JSON, or URL-decoded. Empty bodies are supported. Paste only header values, without header names.

How GitHub signs webhooks

raw_body → HMAC-SHA256 → hex (sha256=)

Use your webhook secret as UTF-8 text, not a GitHub API token. Use X-Hub-Signature-256, not the legacy SHA-1 header.

Common mistakes

  • Verify the raw request body before JSON parsing. Whitespace, field order, Unicode and trailing newlines change the signature.
  • Text entry uses UTF-8; browsers may normalize pasted CRLF to LF. For byte-exact binary or CRLF payloads, choose base64 raw bytes.
  • Signatures establish authenticity, not uniqueness. Your receiver must still deduplicate deliveries and enforce its own replay policy.
  • This is a debugging tool, not a replacement for server-side verification. Prefer synthetic fixtures when possible and clear sensitive input when finished.

Webhook signature verification guide · GitHub testing guide · Official GitHub signing reference