Browser-only developer tool

Standard Webhooks Webhook Signature Verifier

Secrets and payloads never leave your browser. Verification uses Web Crypto locally. Inputs are not saved in URLs or browser storage. No analytics runs on these tool pages.

Nothing is trimmed, parsed as JSON, or URL-decoded. Empty bodies are supported. Paste only header values, without header names.

How Standard Webhooks signs webhooks

webhook-id.timestamp.raw_body → HMAC-SHA256 → base64 (v1,)

Remove whsec_ and base64-decode the secret to bytes (done automatically). Separate rotated v1 signatures with spaces. Asymmetric v1a signatures are not supported.

Common mistakes

  • Verify the raw request body before JSON parsing. Whitespace, field order, Unicode and trailing newlines change the signature.
  • Text entry uses UTF-8; browsers may normalize pasted CRLF to LF. For byte-exact binary or CRLF payloads, choose base64 raw bytes.
  • Signatures establish authenticity, not uniqueness. Your receiver must still deduplicate deliveries and enforce its own replay policy.
  • This is a debugging tool, not a replacement for server-side verification. Prefer synthetic fixtures when possible and clear sensitive input when finished.

Webhook signature verification guide · Standard Webhooks testing guide · Official Standard Webhooks signing reference