HookCheckWebhooks

Signature rejected? Here is why.

Paste the secret, the body received and the header: HookCheck tells you whether the signature is right and, if not, tries the most common mistakes until it finds yours.

€12Opening soon

incl. VAT · one-off · no subscription

Get notified All tools

● hookcheck.html — offline

Screenshot of HookCheck: a GitHub webhook signature verified

5formats: GitHub, Stripe, Slack, Shopify, generic

3algorithms: SHA-256, SHA-1, SHA-512

0network requests

2languages, EN and FR

Features

Check, diagnose, test.

Check

Pick the service, paste the secret, the exact body and the header received: instant verdict, in hex or base64.

Diagnose

If it is rejected, HookCheck tries the usual causes: trailing newline, CRLF line endings, BOM, reformatted JSON, whitespace in the secret, wrong service or wrong algorithm.

Test your endpoint

It builds a test signature and the ready-to-run curl command, without waiting for a real event.

What you get

One file, two languages.

hookcheck.zip: the page in English and French, a read-me and the licence.
Opens in any recent browser, even offline.
No account, no installation, no data sent.
The version you buy and fixes to its bugs.

What it does not do

Honest limits.

It does not receive your application's webhooks: it is for understanding and testing. To receive them, see WebhookNinja Local.
The diagnosis tries a list of common mistakes: no lead does not prove the signature is wrong.
Prefer a test secret: do not use your production secret on a shared computer.

FAQ

Frequently asked questions

Is my secret sent anywhere?

No. The computation runs in your browser and the page forbids any connection. Still, prefer a test secret.

Why must the body be exact?

The signature covers the bytes received. A space, a newline or re-indented JSON is enough to change it: it is the number one cause of rejection.

When can I buy it?

Soon. Sign up below: one single message when sales open.

Waiting list

Get notified at launch.

Leave your e-mail and the tool you are interested in. One message when sales open, nothing else.

WebGuard Tools

The other tools

$ python webhookninja.py serve --mode stripe --target http://127.0.0.1:3000/hook

$ python webhookninja.py list

1 done essais=1 ok

2 done essais=3 ok

3 rejected essais=0 refusee: signature differente

4 dead essais=6 ok HTTP 503

$ python webhookninja.py replay-dead

file morte remise en file

WebhookNinja Local

Webhooks · self-hosted

A webhook receiver you host yourself: signature checked, duplicates ignored, everything kept, forwarded with retries, replayed in one command.

For developers: Python 3.8 and a reachable machine.

€49See the page →

ChainProof

File integrity

Seals a set of files or a folder: a manifest of fingerprints and an overall fingerprint. Later, it tells you what is identical, modified, missing or added.

Proves integrity, not a legally binding date.

€19See the page →

CryptoSign

Signing

Signs and verifies a file or a text, with keys generated on your machine and a password-protected private key. No command line.

Not a qualified eIDAS signature.

€15See the page →