Why does my webhook signature verification keep failing?

The most common culprit is parsing the HTTP request body before verification. If body-parser or Express parses the raw JSON into an object, re-stringifying it changes whitespace and key order, producing a completely different HMAC. You must compute the HMAC over the exact unparsed byte buffer.

How does Stripe compute its webhook signature?

Stripe extracts the timestamp from the Stripe-Signature header (t=...) and concatenates it with the raw request body separated by a period (${timestamp}.${rawBody}). It then computes the HMAC-SHA256 digest using your endpoint secret (whsec_...) and compares it to v1=.

Is it safe to paste my webhook secret into this tool?

Yes. This tool runs 100% client-side inside your browser using the native Web Crypto API (window.crypto.subtle). Your secret keys and payload data never leave your computer and are never sent over the network.

How do I prevent webhook replay attacks?

Compare the timestamp in the webhook header against current server time. If the difference exceeds your tolerance window (typically 300 seconds / 5 minutes), reject the request immediately to prevent attackers from replaying captured network traffic.

What is the difference between GitHub and Shopify webhook signatures?

GitHub uses HMAC-SHA256 formatted as hex prefixed with sha256= in the X-Hub-Signature-256 header. Shopify uses HMAC-SHA256 formatted as Base64 in the X-Shopify-Hmac-SHA256 header.

How do I handle webhooks in Next.js App Router?

In Next.js App Router route handlers, avoid using req.json(). Instead, read the raw body string using await req.text() and pass that raw string directly to your cryptographic verifier.

Webhook Signature Verifier & HMAC Tester Online

Webhook Provider Format Preset

Webhook Signing Secret (e.g., whsec_..., shpss_...)

Webhook Timestamp (t=...) (Unix Epoch Seconds)

Received Signature Header (From HTTP Header)

Raw Request Body (Exact UTF-8 Bytes) ⚠️ Must be RAW string, not parsed JSON

⏳ Ready to verify

Enter signing secret, payload, and signature header to verify integrity.

Computed Canonical Signature:

None

Extracted Expected Signature:

None

Common Webhook Failure Traps

JSON.stringify vs Raw Body: Re-serializing parsed JSON alters whitespace and key order, invalidating HMAC. Always verify against req.rawBody or await req.text().
Timing Attacks: Never use === for signatures. Use constant-time comparison like crypto.timingSafeEqual().
Stripe Pre-pending: Stripe signs ${timestamp}.${rawBody}, not just the body.

Frequently Asked Questions

Is Webhook Signature Verifier & HMAC Tester free to use?

Yes, Webhook Signature Verifier & HMAC Tester is completely free with no signup or registration required. All processing happens directly in your browser.

Is my data safe?

Absolutely. Your data never leaves your device. Everything runs locally in your browser — no uploads, no servers, no tracking.

Do I need to install anything?

No installation needed. Webhook Signature Verifier & HMAC Tester works entirely in your web browser on both desktop and mobile devices.

How do I use

Simply enter or paste your input in the tool above, and the result will be generated instantly. No configuration required.

Common Webhook Failure Traps

Frequently Asked Questions

Explore More Free Developer & Security Engineering Utilities