# Check a webhook signature and see why it fails

> Paste the secret and raw body. It computes the signature, shows the difference and tries common body changes.

Check a webhook signature from GitHub, Stripe, Slack or Shopify, see which characters differ and test common body changes. Runs in your browser.

- Tool: [Webhook signature tester](https://fixmint.cc/webhook-signature-tester)
- Category: [Web & developer](https://fixmint.cc/developer-tools)
- Fixes: Webhook signature check fails
- Runs in the browser: files and text stay on the device, no sign-up, free.

## How to test a webhook signature

1. Choose the provider, then paste the secret and the raw body.
2. Paste the headers, or the whole raw HTTP request, and read the verdict.
3. If it fails, read the body spellings and hints, or make a request to send.

## Questions

### Why must the body be exact?

The signature covers the exact bytes received. Re-formatting JSON, changing line breaks or dropping a trailing newline changes it, so the tool shows which spelling matches.

### Is my secret sent anywhere?

No. The signature is computed in your browser with the Web Crypto API. Only the provider and generic header settings are remembered; the secret and body are not.

### Does the make mode send a request?

No. It prints a curl command with the signature in its headers. Run it yourself, and only against a server you own or are allowed to test.

## Related tools

- [JWT decoder](https://fixmint.cc/jwt-decoder): Token expired, or is it valid?
- [OpenAPI request builder](https://fixmint.cc/openapi-request-builder): Build a call to this API
- [Regex tester](https://fixmint.cc/regex-tester): Regex matches the wrong text
- [JSON Schema validator](https://fixmint.cc/json-schema-validator): Does my JSON fit this schema?