Why does webhook signature verification fail in Express or Next.js even when the secret is correct?

The most common culprit is JSON body parsing middleware (like express.json() or bodyParser). Middleware re-serializes JSON, altering key orders or whitespace. Webhook signatures are computed over the exact raw byte string received over the wire; you must verify using the unparsed raw request buffer (req.rawBody).

How does Stripe's timestamped webhook signature prevent replay attacks?

Stripe signs a concatenated string of the Unix timestamp and the raw payload (timestamp + '.' + payload). The recipient verifies the HMAC signature and checks that the timestamp is within a safe tolerance (typically 300 seconds), ensuring attackers cannot capture and replay old webhook requests.

Is my shared webhook secret safe when testing in this tool?

Yes. All HMAC generation and comparison is performed entirely inside your local browser using the Web Cryptography API (crypto.subtle). Your secret and payloads are never sent to our servers or stored anywhere.

What is the difference between Hex and Base64 HMAC encoding?

HMAC outputs raw binary bytes. Different providers encode these bytes differently: GitHub outputs lower-case hexadecimal strings (sha256=...), whereas Shopify and AWS encode the exact same binary hash as a Base64 string.

Why should webhook verification use timing-safe string comparison?

Standard string equality (=== or strcmp) terminates on the first mismatched character, creating subtle nanosecond timing variations that allow timing attack exploits. Production code should always use constant-time comparisons like Node.js crypto.timingSafeEqual().

Business & Finance

Webhook Payload HMAC-SHA256 Signature Generator & Secret Verifier

Name: Webhook Payload HMAC-SHA256 Signature Generator & Secret Verifier
Author: AnshuTechy

Generate and verify cryptographic HMAC-SHA256, HMAC-SHA1, and HMAC-SHA512 webhook signatures for Stripe, GitHub, Shopify, Slack, and custom APIs. Debug signature header mismatches, raw payload whitespaces, and timestamp replay attacks.Documentation & FAQs ↓

Webhook Payload HMAC-SHA256 Signature Generator & Secret Verifier — Interactive Console

Runs locally in your browser • Instant output

Target Platform:

Webhook Secret Key

Header Timestamp (Unix seconds)

Raw Payload JSON

{
  "id": "evt_3Nsd892eZvKYlo2C01",
  "object": "event",
  "type": "payment_intent.succeeded",
  "data": {
    "object": {
      "amount": 4900,
      "currency": "usd",
      "status": "succeeded"
    }
  }
}

Verify Incoming Request Header

Paste Incoming Signature to Compare:

Computed Valid Signature

Generating signature...

Node.js Verification Handler

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

try {
  const event = stripe.webhooks.constructEvent(
    req.body,
    req.headers['stripe-signature'],
    'whsec_9b7c846d1e4a3b7c846d1e4a3b7c846d'
  );
  console.log('Verified Stripe Event:', event.type);
} catch (err) {
  console.error('Signature failure:', err.message);
}

Python Verification Handler

import stripe

try:
    event = stripe.Webhook.construct_event(
        payload=request.data,
        sig_header=request.headers.get('stripe-signature'),
        secret='whsec_9b7c846d1e4a3b7c846d1e4a3b7c846d'
    )
except ValueError as e:
    raise e

Step-by-Step Instructions

4 Steps to Completion

1Phase 1

Select your webhook provider profile (Stripe, GitHub, Shopify, or Custom HMAC).

2Phase 2

Paste the shared webhook secret key and raw request payload JSON into the input fields.

3Phase 3

Optional: Provide the received webhook signature header to perform an instant verification comparison.

4Phase 4

Inspect the calculated hex/base64 HMAC signature, comparison result, and copy-ready server verification code snippets (Node.js, Python, Go).

Practical Use Cases & Real-World Scenarios

Debugging Failed Stripe Webhook Verifications

Diagnose why your local development webhook listener rejects Stripe signatures due to JSON body parsing alterations or missing raw body buffers.

Testing GitHub & Shopify Webhook Integrations

Verify that payload signatures calculated with your shared secret match the signature headers delivered by GitHub or Shopify before deploying serverless handlers.

Simulating Webhook Calls in Postman or cURL

Generate valid HMAC signature headers for simulated webhook payloads to test staging API endpoints without triggering live third-party transactions.

Related Editorial Guide on AnshuTechy15 Best Automation Testing Tools & Software in 2026

Read Tutorial →

Share With Your Community

Found this tool helpful? Share it with colleagues & friends:

100% free, private in-browser utility with zero server uploads.

Webhook Payload HMAC-SHA256 Signature Generator & Secret Verifier

Verify Incoming Request Header

Step-by-Step Instructions

Practical Use Cases & Real-World Scenarios

Multi-Platform Signature Header Presets

Raw Payload Whitespace & Byte Verification

Hardware-Accelerated Web Crypto HMAC

Timestamp Tolerance & Replay Protection Simulator

Frequently Asked Questions

15 Best Automation Testing Tools & Software in 2026

Found this tool helpful? Share it with colleagues & friends: