Webhook Payload Verification Signature Calculator

Every provider uses HMAC-SHA256. They differ in what they feed into it, and that difference is why a verification that works for GitHub fails for Stripe.

What each provider signs

The "bytes actually signed" panel shows the constructed string for whichever provider you select, which is usually enough to spot the mismatch immediately.

The raw body problem

Overwhelmingly the most common cause of a failed verification. Your framework parses JSON before your handler runs, and you sign JSON.stringify(req.body) — which is not the bytes that arrived. Key order, whitespace and Unicode escaping all differ.

Every provider's documentation says to use the raw body. Every framework makes that inconvenient. Configure it explicitly:

// Express — capture the buffer during parsing
app.use("/webhooks", express.json({
  verify: (req, _res, buf) => { req.rawBody = buf; },
}));

// Next.js App Router — read text first, parse second
export async function POST(request: Request) {
  const raw = await request.text();
  if (!verify(raw, request.headers.get("stripe-signature"))) {
    return new Response("Invalid signature", { status: 400 });
  }
  const event = JSON.parse(raw);
}

The timestamp is not decoration

Stripe, Slack and Svix include a timestamp in the signed payload so you can reject old requests. Without that check, a captured request is replayable forever — and a payment_intent.succeeded replayed a thousand times is a thousand fulfilments.

Five minutes is the standard tolerance. This tool flags a signature that is cryptographically valid but outside the window, because that is exactly the case a correct implementation must reject and a naive one accepts.

Verification order

1. Read the raw body.
2. Check the timestamp is within tolerance. Reject early if not.
3. Compute the expected signature over the provider's constructed string.
4. Compare in constant time.
5. Only then parse the JSON and act on it.

Parsing before verifying means you are running your JSON parser on unauthenticated attacker input.