Webhook Payload Tester & HMAC Signature Verifier – Stripe, Shopify & GitHub
Why Webhook Signature Verification Is Essential
Webhooks are asynchronous HTTP POST callbacks sent by third-party platforms (such as Stripe, Shopify, GitHub, or PayPal) to notify your server of critical business events (such as successful payments, chargebacks, or code pushes). Because webhook endpoints are public, anyone can attempt to forge fraudulent POST requests.
How HMAC-SHA256 Signing Works
To guarantee payload authenticity, providers compute a Hash-based Message Authentication Code (HMAC) using a shared secret key. The receiving server must recalculate the exact same cryptographic hash using the raw, unparsed request body and compare it in constant time (timing-safe comparison).
Common Pitfalls in Webhook Verification
- JSON Re-serialization Drift: Verifying parsed JSON objects instead of the exact raw byte stream will fail due to altered whitespace or object key ordering.
- Timestamp Tolerance: Stripe embeds a Unix timestamp (
t=...) inside the signature header to prevent replay attacks. Signatures older than 5 minutes must be rejected.
Frequently asked questions
Why is my computed webhook signature different from Stripe?
Ensure you are signing timestamp.rawPayload, where timestamp is extracted from the t= header value, using the raw binary body before express.json() parses it.
Is it safe to paste webhook secret keys here?
Yes. Calculations execute 100% on-device inside your browser using the native Web Crypto API. Your secret keys never travel across any network.
Receive, queue, and retry high-volume webhooks with zero packet loss and automatic idempotency.