Debug webhook HMAC-SHA256 signature failures for Stripe, GitHub, Shopify, or any provider. Paste payload, secret key, and signature header — computed vs received shown side by side. Nothing leaves your browser.
Free, no sign-up — one of the SaaSQuickStart Developer tools.
Yes. All computation happens in your browser using the built-in Web Crypto API (SubtleCrypto). Nothing is sent to any server. The secret never leaves your browser tab.
The most common cause is body parsing. If your framework parses the JSON body before you read it, the raw bytes differ from what the provider signed. Always read the raw Buffer/bytes for the webhook route, not the parsed object. For Stripe, also ensure you're using the full Stripe-Signature header value (including the t= timestamp part), not just the v1= portion.
v0 is a legacy signature scheme (HMAC-SHA256 of just the raw body, without the timestamp prefix). v1 is the current scheme and includes the timestamp to prevent replay attacks. Stripe includes both in the Stripe-Signature header. This verifier uses v1.