Webhook Signature Test Workbench

How to use Webhook Signature Test Workbench

Generate or compare local GitHub, Stripe and Slack HMAC-SHA256 webhook fixtures while preserving the exact raw request-body bytes. Check provider header framing, explicit timestamps and a supplied diagnostic clock. The result shows a body digest and expected signature headers, with secret/body contents omitted; it never delivers or authorizes an event.

1. Provide optional raw utf-8 body file, raw utf-8 request body, including original whitespace, raw utf-8 signing secret, optional supplied signature header value for comparison, optional timestamp seconds for generation or slack comparison, explicit current unix seconds for timestamp comparison, positive timestamp tolerance seconds.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• Raw UTF-8 request body up to 65,536 bytes, pasted or read from one local file. Empty bodies are supported; invalid UTF-8 is refused. Original BOM, CRLF, spaces, JSON key order and trailing newlines are preserved as bytes. The tool does not parse or reserialize event JSON, URL-encoded forms or event schemas.
• Raw UTF-8 secret is 1–1,024 bytes, with whitespace preserved rather than trimmed or hex-decoded. It is never returned or read from the environment. Use original public fixture secrets when learning; an HMAC result does not establish who supplied a real secret.
• GitHub uses sha256= plus a lowercase HMAC-SHA256 hex digest over raw bytes. Slack uses v0:timestamp:raw-body and v0= in the signature header, with a separate X-Slack-Request-Timestamp. Stripe uses timestamp.raw-body with t= and one or more v1= components.
• Selected signature headers are printable ASCII with no folding and at most 8,192 bytes. GitHub/Slack accept one exact scheme and lowercase 64-digit digest. Stripe accepts up to 32 unspaced comma-separated components, one timestamp and up to 16 v1 digests; unknown schemes are listed by name only. Repeated timestamps, extra separators, uppercase digest spelling and SDK-specific coercions are refused.
• Timestamp strings are canonical unsigned Unix seconds from 0 through 9,999,999,999. Comparison uses your explicit clock and a positive tolerance of 1–86,400 seconds. Slack applies an absolute age window; the labeled Stripe Node SDK-style check rejects stale age only and separately flags future timestamps. No implicit current clock is used.
• GitHub comparison provides no timestamp/replay window. A matching signature or local age check is not sender authentication, event authorization, duplicate-delivery protection or a production webhook handler. The three providers remain modes in this one workflow.
• The report omits raw body, secret and supplied header values; it includes a body SHA-256 identifier, generated expected header and source-independent diagnostics. WebCrypto performs HMAC verification. String memory cannot be erased reliably; clear the local form when finished.
• A dedicated Worker prepares the requested core before ready, with a 10-second preparation deadline and a separate 2-second computation limit. WebCrypto is required. No event, account, endpoint, request, local path or environment resource is contacted.
• The formatted report is limited to 500,000 characters. Reduce the source when that output budget is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.