Browser-only developer tool

Shopify Webhook Signature Verifier

Secrets and payloads never leave your browser. Verification uses Web Crypto locally. Inputs are not saved in URLs or browser storage. No analytics runs on these tool pages.

Nothing is trimmed, parsed as JSON, or URL-decoded. Empty bodies are supported. Paste only header values, without header names.

How Shopify signs webhooks

raw_body → HMAC-SHA256 → base64

Use your app client secret as UTF-8 text. The signature is standard base64, not hex. This checks HTTPS webhook bodies, not OAuth query-string HMACs.

Common mistakes

  • Verify the raw request body before JSON parsing. Whitespace, field order, Unicode and trailing newlines change the signature.
  • Text entry uses UTF-8; browsers may normalize pasted CRLF to LF. For byte-exact binary or CRLF payloads, choose base64 raw bytes.
  • Signatures establish authenticity, not uniqueness. Your receiver must still deduplicate deliveries and enforce its own replay policy.
  • This is a debugging tool, not a replacement for server-side verification. Prefer synthetic fixtures when possible and clear sensitive input when finished.

Webhook signature verification guide · Shopify testing guide · Official Shopify signing reference