Browser-only developer tool

Slack Webhook Signature Verifier

Secrets and payloads never leave your browser. Verification uses Web Crypto locally. Inputs are not saved in URLs or browser storage. No analytics runs on these tool pages.

Nothing is trimmed, parsed as JSON, or URL-decoded. Empty bodies are supported. Paste only header values, without header names.

How Slack signs webhooks

v0:timestamp:raw_body → HMAC-SHA256 → hex (v0=)

Use the signing secret, not the deprecated verification token. Keep form-encoded bodies exactly as sent: do not decode %2F or turn + into spaces.

Common mistakes

  • Verify the raw request body before JSON parsing. Whitespace, field order, Unicode and trailing newlines change the signature.
  • Text entry uses UTF-8; browsers may normalize pasted CRLF to LF. For byte-exact binary or CRLF payloads, choose base64 raw bytes.
  • Signatures establish authenticity, not uniqueness. Your receiver must still deduplicate deliveries and enforce its own replay policy.
  • This is a debugging tool, not a replacement for server-side verification. Prefer synthetic fixtures when possible and clear sensitive input when finished.

Webhook signature verification guide · Slack testing guide · Official Slack signing reference