---
title: "Verify Slack Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Slack webhook signature verifier. Validate the X-Slack-Signature header against your app's signing secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Slack Webhook Signatures — Free Online Tool"
description: "Free online Slack webhook signature verifier. Validate the X-Slack-Signature header against your app's signing secret. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Slack Webhook Signatures**
Slack signs requests by building the string `v0:{timestamp}:{body}` and computing HMAC-SHA256 with your app's signing secret. The result is sent (prefixed `v0=`) in `X-Slack-Signature`, with the timestamp in `X-Slack-Request-Timestamp`. Paste the raw body, secret, timestamp and signature.
**Raw request body (payload)**
**Timestamp** (X-Slack-Request-Timestamp)
**Signing secret**
**Computed signature**
**Signature to verify **(X-Slack-Signature)
**Paste the X-Slack-Signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-slack-webhook-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-slack-webhook-signature/hmac-verification/).
## **How Slack signs webhooks**
1. Build the base string `v0:{X-Slack-Request-Timestamp}:{raw body}`.
2. Compute HMAC-SHA256 using your signing secret as the key, hex-encoded.
3. Prefix with `v0=` and compare to `X-Slack-Signature` with a constant-time check.
4. Reject requests whose timestamp is more than ~5 minutes old to prevent replays.
**References & official docs:**
- [Slack — Verifying requests from Slack](https://api.slack.com/authentication/verifying-requests-from-slack)
## **Verify Slack signatures in code**
**Node.js**
```
const crypto = require('crypto');
const ts = req.headers['x-slack-request-timestamp'];
const base = \`v0:${ts}:${rawBody}\`;
const sig = 'v0=' + crypto
.createHmac('sha256', process.env.SLACK_SIGNING_SECRET)
.update(base).digest('hex');
const valid = crypto.timingSafeEqual(
Buffer.from(sig), Buffer.from(req.headers['x-slack-signature']));
```
**Python**
```
import hmac, hashlib
ts = request.headers['X-Slack-Request-Timestamp']
base = f"v0:{ts}:{raw_body}"
sig = 'v0=' + hmac.new(
signing_secret.encode(), base.encode(), hashlib.sha256).hexdigest()
valid = hmac.compare_digest(sig, request.headers['X-Slack-Signature'])
```
## **Frequently asked questions**
**Where is the Slack signing secret?**
In your app's settings at api.slack.com under "Basic Information" → "App Credentials" → "Signing Secret". It is different from a bot or OAuth token.
**Why include the timestamp?**
Signing `v0:{timestamp}:{body}` binds the signature to a moment in time, so you can reject old requests and stop attackers replaying a captured payload.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-slack-webhook-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-slack-webhook-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-slack-webhook-signature/verify-shopify-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-slack-webhook-signature/verify-twilio-webhook-signature/) [**S** Standard Webhooks](https://webhookrelay.com/verify-slack-webhook-signature/verify-standard-webhooks-signature/) [ Square](https://webhookrelay.com/verify-slack-webhook-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-slack-webhook-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-slack-webhook-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-slack-webhook-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-slack-webhook-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-slack-webhook-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-slack-webhook-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-slack-webhook-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-slack-webhook-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-slack-webhook-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-slack-webhook-signature/webhook-bin/)
Receiving Slack webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-slack-webhook-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-slack-webhook-signature/features/transform-webhooks/) before delivery.