Webhook Signature Verifier & HMAC SHA-256 Tester

Verify and troubleshoot Stripe, GitHub, Shopify, and Svix webhook HMAC SHA-256 signatures in real-time.

Provider Preset:

Webhook Signing Secret:

Header Timestamp (t):

Incoming Header Signature to Test:

Raw Webhook JSON Payload

Locally Computed HMAC SHA-256 Digest

Enter payload and secret to compute

Backend Implementation Code

// Node.js (Express / Next.js) Stripe Webhook Handler
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function handleWebhook(req, res) {
  const sig = req.headers['stripe-signature'];
  const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET;

  let event;
  try {
    // Note: req.body MUST be raw Buffer, not parsed JSON
    event = stripe.webhooks.constructEvent(req.rawBody, sig, endpointSecret);
  } catch (err) {
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  // Handle event
  if (event.type === 'payment_intent.succeeded') {
    const paymentIntent = event.data.object;
  }
  res.json({ received: true });
}

How Webhook HMAC Signatures Prevent Tampering

When external SaaS platforms (like Stripe, GitHub, or Shopify) push HTTP webhook events to your application endpoint, verifying the HMAC SHA-256 signature header is critical. It guarantees that the incoming request actually originated from the authentic vendor and was not intercepted, modified, or forged by an attacker.

Common Webhook Verification Pitfalls

Parsing JSON Before Verification: Re-serializing an already parsed JSON object alters whitespace, newline characters, and key ordering, causing signature validation to fail. Always verify the raw, unparsed request Buffer.
Timing Attacks: Standard string equality checks (sig === computed) exit early on the first mismatched character, creating a side-channel timing vulnerability. Always use constant-time comparisons like Node.js crypto.timingSafeEqual or Python hmac.compare_digest.
Timestamp Replay Attacks: Stripe prefixes signatures with a Unix timestamp (t=169...). Applications should reject webhooks with timestamps older than 5 minutes to prevent replay attacks.