GitHub Webhook Signature Tester (`X-Hub-Signature-256: sha256=...`)
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.
Verify Received X-Hub-Signature-256 Header
How do I use GitHub Webhook Signature Tester (`X-Hub-Signature-256: sha256=...`)?
Notice the tool is pre-configured to 'GitHub (sha256=)' mode with `SHA-256`, `HEX` encoding, and a sample GitHub `push` event payload.
Enter your repository or GitHub App Webhook Secret.
Paste the raw JSON webhook payload to generate the exact `sha256=<hex_digest>` value for the `X-Hub-Signature-256` header.
Copy the header for cURL/Postman testing or paste a received `X-Hub-Signature-256` header into the bottom box to verify it.
What features does GitHub Webhook Signature Tester (`X-Hub-Signature-256: sha256=...`) offer?
Pre-configured for GitHub's `X-Hub-Signature-256` (`sha256=` prefix + lowercase hex HMAC-SHA256)
Also supports legacy `X-Hub-Signature` (`SHA-1`) when toggling the algorithm button
Pre-loaded with an authentic GitHub `push` event JSON payload (`refs/heads/main` on `octocat/Hello-World`)
Verifier box matches both `sha256=<hex>` header strings and raw 64-character hex digests
Ideal for building CI/CD runners, Probot apps, and GitOps deployment webhooks
100% Client-Side Web Crypto API: GitHub App webhook secrets never leave your browser
GitHub `X-Hub-Signature-256` Specification & Constant-Time Verification
GitHub signs the raw HTTP request body with HMAC-SHA256 and prepends the literal string `sha256=` to the 64-character lowercase hex digest.
X-Hub-Signature-256 = "sha256=" + HMAC_SHA256_HEX(webhook_secret, raw_payload)Always compare the full `sha256=...` string using `crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))`.
| GitHub Header | Format | Status | Security Recommendation |
|---|---|---|---|
| X-Hub-Signature-256 | sha256=<64-char-hex> | Recommended Standard | Always validate using HMAC-SHA256 |
| X-Hub-Signature | sha1=<40-char-hex> | Legacy (Deprecated) | Only use for legacy integrations |
| X-GitHub-Event | push / pull_request / issues | Active | Filter expected event types early |
| X-GitHub-Delivery | 72d3162e-cc78-11e3-81ab... | Active (UUID) | Log delivery GUID for replay debugging |
How is GitHub Webhook Signature Tester (`X-Hub-Signature-256: sha256=...`) used in real-world workflows?
Testing Custom Self-Hosted Runner & Deployment Webhooks
Generate valid `X-Hub-Signature-256: sha256=...` headers to trigger local CI/CD webhook listeners without pushing dummy commits to GitHub.
Debugging Webhook Secret Mismatches on `pull_request` Events
Copy the raw payload from `GitHub Settings > Webhooks > Recent Deliveries` and verify it against your local `.env` `WEBHOOK_SECRET`.
Validating Webhook Authentication Controls in Penetration Tests
Craft signed and tampered payloads to confirm that webhook endpoints reject modified bodies or missing `sha256=` prefixes.
Frequently Asked Questions about GitHub Webhook Signature Tester (`X-Hub-Signature-256: sha256=...`)
What is the difference between `X-Hub-Signature-256` and `X-Hub-Signature`?
`X-Hub-Signature-256` uses HMAC-SHA256 (`sha256=<64-char-hex>`) and is GitHub's recommended security standard. `X-Hub-Signature` uses legacy HMAC-SHA1 (`sha1=<40-char-hex>`) and is retained only for backward compatibility.
Why does GitHub recommend `crypto.timingSafeEqual` instead of `===`?
Standard string equality (`===`) returns `false` on the first mismatched byte, which leaks timing information (a side-channel timing attack). `crypto.timingSafeEqual` compares all bytes in constant time.
What happens if my GitHub webhook payload is sent as `application/x-www-form-urlencoded`?
If your GitHub webhook Content type is set to `application/x-www-form-urlencoded` instead of `application/json`, GitHub signs the URL-encoded string `payload=%7B...%7D`. We recommend setting Content type to `application/json` in your GitHub webhook settings.
Are my GitHub webhook secrets transmitted anywhere?
No. Everything executes 100% locally in your browser using the Web Crypto API.
Explore Related Developer Tools
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
UUID v4 / v7 Generator
Generate cryptographically secure UUID v4, time-sorted UUID v7, UUID v1, and deterministic UUID v5 in single or bulk batches.
Password Generator
Generate strong random passwords with custom length, character sets, and bit entropy meter.