# Webhook signature verifier (HMAC)

Paste the raw body, your webhook secret and the signature you received. The page computes the HMAC in your browser, tells you whether it matches and, when it doesn't, which usual mistake would make it match.

## How webhook signatures work

A webhook sender and your server share a secret. For every delivery the sender computes an HMAC of the request body with that secret and puts it in a header. Your server computes the same HMAC from the body it received and compares the two. When they match, the delivery came from someone who knows the secret and the body was not changed on the way.

## Sign the raw bytes

The HMAC covers the exact bytes of the body. If your framework parses the JSON and you encode it again, the spacing, key order or escaping can change, and the signature no longer matches. Read the raw body before any parsing, and compare in constant time (hash_equals in PHP, hmac.compare_digest in Python, crypto.timingSafeEqual in Node).

## PostBoost webhooks

When a webhook has a secret (webhooks created over the API always have one), PostBoost signs every delivery with HMAC-SHA256 of the raw body and sends it as a hex string in X-Signature. A secret is optional for webhooks added in the app. The sample deliveries above use the secret whsec_test so you can see a valid result first, then change one character and watch the hints. Server code for Python and Node is in the [webhooks docs](/docs/webhooks/#verifying-signatures), and you can create a webhook from the API or the app.

## What the hints check

When a signature is invalid, the verifier tries one fix at a time: strip a prefix such as sha256=, drop a trailing newline, trim spaces around the secret, switch hex and base64, try the other algorithms, and re-encode the JSON the two common ways. Every hint you see is one of those checks that turned the result valid.

## How to use

1. Pick the sender: PostBoost, GitHub, or Other to set the algorithm, encoding and prefix yourself.
2. Paste the raw request body exactly as your server received it, or load a sample PostBoost delivery.
3. Enter the webhook secret and the signature from the request header.
4. Read the verdict. When it is invalid, the hints name the mistake that would make it valid.
5. Fix your server code, then verify a new delivery the same way.

## FAQ

### Is my secret sent anywhere?

No. The page computes the HMAC with your browser's Web Crypto API and sends nothing. Use a test secret anyway: a production secret does not belong in any third-party page or service.

### How does PostBoost sign webhooks?

When the webhook has a secret (webhooks created over the API always do), each delivery has an X-Signature header: the HMAC-SHA256 of the raw request body with your webhook's secret, as a lowercase hex string with no prefix. Compare it with your own HMAC in constant time before you trust the payload.

### Why does my signature not match?

Usually the body is not the raw bytes that were signed: a framework parsed the JSON and you re-encoded it, or a trailing newline was added. A wrong secret, a wrong encoding (hex or base64) and a sha256= prefix left on the header value are the other usual causes. The hints check each of these for you.

### How do I verify GitHub webhooks?

GitHub sends X-Hub-Signature-256: the HMAC-SHA256 hex digest of the body, prefixed with sha256=. Pick the GitHub sender here, which strips the prefix before comparing.

### Does it support Stripe or Slack signatures?

No. Stripe and Slack sign a timestamp together with the body, so a plain body HMAC never matches them. Use their official libraries to verify those.

### Can I verify signatures from code or an AI agent?

Yes. The same check is on the free PostBoost API and MCP server as verifyWebhookSignature. It runs on our server, so send only test secrets and sample payloads to it.

## Related

- [Social media API request builder](https://postboost.co/tools/social-media-api-request-builder): Build a create-post request for the PostBoost social media API and copy it as curl, Python, Node.js, PHP, Go, Ruby, Java, C#, Rust or the CLI.
- [MCP server config generator for social media](https://postboost.co/tools/mcp-config-generator): Get the exact MCP setup to connect Claude, ChatGPT, Claude Code, Cursor, VS Code, Codex, Gemini CLI or n8n to PostBoost's social media MCP server.
- [X API cost calculator](https://postboost.co/tools/x-api-cost-calculator): Estimate your monthly X (Twitter) API bill from posts, link posts, replies and reads at X's pay-per-use prices, with the link-post premium shown.
- [Automations](https://postboost.co/features/automations): Add an RSS feed and new articles become drafts or queued posts.

Last verified: 2026-10-17

## Sources

- [PostBoost docs, Webhooks: Verifying signatures](https://postboost.co/docs/webhooks/#verifying-signatures)
- [GitHub Docs, Validating webhook deliveries (X-Hub-Signature-256)](https://docs.github.com/en/webhooks/using-webhooks/validating-webhook-deliveries)

Canonical: https://postboost.co/tools/webhook-signature-verifier