---
title: "Verify Standard Webhooks Webhook Signatures — Free Online Tool | WebhookRelay"
meta:
"og:description": "Free online Standard Webhooks webhook signature verifier. Validate the webhook-signature header used by the Standard Webhooks spec. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
"og:title": "Verify Standard Webhooks Webhook Signatures — Free Online Tool"
description: "Free online Standard Webhooks webhook signature verifier. Validate the webhook-signature header used by the Standard Webhooks spec. Paste the payload, secret and signature to check it instantly — runs in your browser, no signup."
---
# **Verify Standard Webhooks Webhook Signatures**
Standard Webhooks (used by Svix, OpenAI, Anthropic and many others) signs the string `{webhook-id}.{webhook-timestamp}.{body}` with HMAC-SHA256. The base64 result is sent (prefixed `v1,`) in `webhook-signature`. The signing secret is base64 after its `whsec_` prefix and is decoded before use. Paste the id, timestamp, body, secret and signature.
**Raw request body (payload)**
**Webhook ID **(webhook-id)
**Timestamp** (webhook-timestamp)
**Signing secret**
**Computed signature**
**Signature to verify **(webhook-signature)
**Paste the webhook-signature value above to compare**
Everything runs in your browser — the payload and secret never leave this page. Want to verify a different provider? See the [webhook signature verifier hub](https://webhookrelay.com/verify-standard-webhooks-signature/verify-webhook-signature/) or the generic [HMAC generator](https://webhookrelay.com/verify-standard-webhooks-signature/hmac-verification/).
## **How Standard Webhooks signs webhooks**
1. Read `webhook-id`, `webhook-timestamp` and `webhook-signature` from the headers.
2. Build the signed content `{id}.{timestamp}.{raw body}`.
3. Base64-decode your secret (the part after `whsec_`) and use those bytes as the HMAC-SHA256 key.
4. Base64-encode the digest, prefix `v1,` and constant-time compare against any signature in `webhook-signature`.
**References & official docs:**
- [Standard Webhooks](https://www.standardwebhooks.com/)
- [Standard Webhooks — Specification](https://github.com/standard-webhooks/standard-webhooks/blob/main/spec/standard-webhooks.md)
## **Verify Standard Webhooks signatures in code**
**Node.js**
```
const { Webhook } = require('standardwebhooks');
const wh = new Webhook(process.env.WEBHOOK_SECRET); // whsec_...
const payload = wh.verify(rawBody, {
'webhook-id': req.headers['webhook-id'],
'webhook-timestamp': req.headers['webhook-timestamp'],
'webhook-signature': req.headers['webhook-signature'],
});
```
**Python**
```
from standardwebhooks import Webhook
wh = Webhook(webhook_secret) # whsec_...
payload = wh.verify(raw_body, {
"webhook-id": headers["webhook-id"],
"webhook-timestamp": headers["webhook-timestamp"],
"webhook-signature": headers["webhook-signature"],
})
```
## **Frequently asked questions**
**What is Standard Webhooks?**
An open specification (backed by Svix and a steering committee from Zapier, Twilio, ngrok, Supabase and others) for signing and sending webhooks consistently. Providers like OpenAI, Anthropic and Google Gemini use it.
**How is the secret used?**
The signing secret is base64-encoded with a `whsec_` prefix. Strip the prefix, base64-decode the rest to raw bytes, and use those bytes as the HMAC-SHA256 key — not the literal string.
**How is this different from Stripe?**
Both use HMAC-SHA256 with a timestamp, but Standard Webhooks also signs a unique message id, outputs base64 (not hex), and decodes its secret from base64 first.
## **Verify other providers**
[Stripe](https://webhookrelay.com/verify-standard-webhooks-signature/verify-stripe-webhook-signature/) [ GitHub](https://webhookrelay.com/verify-standard-webhooks-signature/verify-github-webhook-signature/) [ Shopify](https://webhookrelay.com/verify-standard-webhooks-signature/verify-shopify-webhook-signature/) [ Slack](https://webhookrelay.com/verify-standard-webhooks-signature/verify-slack-webhook-signature/) [ Twilio](https://webhookrelay.com/verify-standard-webhooks-signature/verify-twilio-webhook-signature/) [ Square](https://webhookrelay.com/verify-standard-webhooks-signature/verify-square-webhook-signature/) [**L** LINE](https://webhookrelay.com/verify-standard-webhooks-signature/verify-line-webhook-signature/) [**A** Airwallex](https://webhookrelay.com/verify-standard-webhooks-signature/verify-airwallex-webhook-signature/) [**M** MyFatoorah](https://webhookrelay.com/verify-standard-webhooks-signature/verify-myfatoorah-webhook-signature/) [ Zendesk](https://webhookrelay.com/verify-standard-webhooks-signature/verify-zendesk-webhook-signature/) [ DocuSign](https://webhookrelay.com/verify-standard-webhooks-signature/verify-docusign-webhook-signature/) [**K** Klarna](https://webhookrelay.com/verify-standard-webhooks-signature/verify-klarna-webhook-signature/) [**A** Attio](https://webhookrelay.com/verify-standard-webhooks-signature/verify-attio-webhook-signature/)
[HMAC Generator](https://webhookrelay.com/verify-standard-webhooks-signature/hmac-verification/) [CloudEvents Validator](https://webhookrelay.com/verify-standard-webhooks-signature/cloudevents-validator/) [Webhook Tester (Bin)](https://webhookrelay.com/verify-standard-webhooks-signature/webhook-bin/)
Receiving Standard Webhooks webhooks on a server behind a firewall or on localhost? Webhook Relay can [forward them to your internal service](https://webhookrelay.com/verify-standard-webhooks-signature/webhooks/) and even [verify or transform them](https://webhookrelay.com/verify-standard-webhooks-signature/features/transform-webhooks/) before delivery.