Encrypt Online
Theme

Webhook Signature Verify

Recreate the exact bytes your provider signed and compare them

Safety note: Use the raw request body from your framework before JSON parsing changes it. This helper keeps request bodies and secrets.
Webhook verificationCompare the exact signing string, digest, and provided signature in one place
Provider:
Why Raw Body Matters

Providers sign the exact request bytes they send. If your framework parses JSON, rewrites whitespace, or changes newlines before you verify, the signature no longer matches even when the payload looks identical.

How to Verify a Webhook
  1. Paste the raw request body before any JSON parsing.
  2. Paste the shared secret and the provider signature header.
  3. Use the preset that matches the provider, or Generic for direct HMAC comparisons.
  4. Review the reconstructed signing string, expected digest, and mismatch causes.
Provider Presets
  • Stripe: signs timestamp.raw_body and expects the v1 digest from the signature header.
  • GitHub: signs the raw body and compares it with sha256=<hex> or legacy sha1=<hex>.
  • Generic: compare any HMAC digest when you already know the algorithm and encoding.
Common Mismatch Causes
  • Using parsed JSON instead of the raw request body.
  • Loading the wrong secret for the current environment or endpoint.
  • Ignoring timestamp tolerance or replay windows for Stripe-style signatures.
  • Comparing a hex digest against Base64 or Base64URL output.
Reproducible Evidence

This tool has a versioned public record with three synthetic cases. Each expected result is recomputed from the production diagnostic core during the release check; the record also publishes fixture and source SHA-256 digests.

  • WEBHOOK-HMAC-VALID-001valid
    A provided generic HMAC matches the exact synthetic raw body.
  • WEBHOOK-HMAC-MISMATCH-002mismatch
    The supplied digest does not match the digest of the exact synthetic raw body.
    Expected code: SIGNATURE_MISMATCH.
  • WEBHOOK-GITHUB-HEADER-MALFORMED-003malformed
    A GitHub-style header names an unsupported sha512 prefix.
    Expected code: INVALID_SIGNATURE_HEADER.

Open the complete citation evidence record (JSON)

Implementation source-sha256:291dced379f090ab; verified 2026-08-05. Read the record's scope before citing a result; structural or cryptographic evidence is not automatically an identity or trust verdict.

FAQ
Can I use this with live webhook requests?

Use it for debugging copied request bodies and headers. It does not receive webhooks for you.

Does the page store my secret?

Recreate the exact provider signing input and compare the expected and supplied signatures. Preserve the raw request body before parsing.

Why does Stripe care about the timestamp?

Timestamp checks help prevent replay. A valid HMAC can still be rejected when the header is too old.