Spoold Logo
Back to Blog
9 min read
Guide

Webhook HMAC Signature Verifier — Debug Stripe, GitHub & Slack Signatures

Verify webhook HMAC-SHA256 signatures online for Stripe, GitHub, and Slack. Learn each signed-payload format, fix signature mismatches, and test safely in your browser.

By Spoold Editorial TeamReviewed for tool accuracy
Editorial Policy
Open Webhook HMAC VerifierMore guides
#webhook signature#hmac sha256#stripe webhook#github webhook#slack signing secret#verify webhook online#Developer Tools

Find out why your webhook signature fails.

Getting "signature verification failed" from Stripe, GitHub, or Slack? Spoold's Webhook HMAC Verifier recomputes the HMAC-SHA256 in your browser and shows the expected digest next to what the provider sent.

Open the webhook verifier →

How webhook signatures work

The sender computes an HMAC-SHA256 over the request using a shared secret and puts the digest in a header. Your server recomputes it and compares. If anything differs — the secret, a single byte of the body, or the timestamp — the digests diverge completely, which is exactly why debugging by eye is impractical.

What each provider signs

Stripe — header Stripe-Signature: t=1700000000,v1=… signs `${t}.${rawBody}`
GitHub — header X-Hub-Signature-256: sha256=… signs rawBody
Slack — headers X-Slack-Signature: v0=… + X-Slack-Request-Timestamp signs `v0:${timestamp}:${rawBody}`

Why signatures fail

Body was modified

Frameworks that parse JSON and re-serialize it change whitespace and key order. Verify against the raw bytes instead.

Wrong secret

Stripe has a different whsec_ per endpoint; Slack needs the signing secret, not the bot token; test and live modes differ.

Timestamp issues

Stripe and Slack sign the timestamp too. Servers also reject old timestamps (usually > 5 minutes) to stop replays.

Encoding quirks

A trailing newline, CRLF conversion, or a proxy that decompresses and re-encodes the body will break the match.

How to verify on Spoold

  1. Open /tools/web/webhook-verify.
  2. Pick Stripe, GitHub, or Slack.
  3. Enter the secret and paste the raw body and the signature header (plus timestamp for Slack).
  4. Read the Match / Mismatch chip and compare the expected digest.

Security: use test secrets

The tool runs locally and never stores or shares the secret, but you should still not paste production secrets on untrusted or shared machines. Use test-mode secrets, or rotate the secret afterward.

Verifying in code

Prefer the provider SDK (stripe.webhooks.constructEvent, Octokit's webhooks package, Slack Bolt). If you roll your own, compute the HMAC over the raw body and compare with a constant-time function such as Node's crypto.timingSafeEqual, then enforce a timestamp tolerance.

Related guides

Related search terms

webhook signature verificationverify webhook signature onlinehmac sha256 webhookstripe-signature headerx-hub-signature-256slack signing secretwebhook signature mismatchwebhook replay protection

Frequently asked questions

Is the verifier free and private?
Yes. It uses the browser's Web Crypto API; nothing is uploaded, and secrets are excluded from history and sharing.
Why does JSON.stringify(req.body) not verify?
HMAC covers exact bytes. Re-serializing changes whitespace or key order. Capture the raw body before parsing.
Which Stripe secret should I use?
The endpoint's whsec_ signing secret from the Dashboard or the Stripe CLI, used as-is including the prefix.
Does GitHub's older X-Hub-Signature work?
No. That header uses SHA-1. This tool verifies the SHA-256 X-Hub-Signature-256 header.
Does it check replay protection?
It flags matching Stripe/Slack signatures whose timestamp is older than 5 minutes, but your server must enforce tolerance itself.

Verify a webhook signature

Paste a test payload into the webhook signature verifier.

Webhook HMAC VerifierHash GeneratorHTTP Request

Related Tools

Hash Generator

Try it

curl Online / HTTP Request

Try it

JWT Decoder

Try it

Related Articles

Guide

MCP Inspector Online — Read mcp.json and Tool Schemas

Inspect Model Context Protocol configs and tools/list payloads in the browser. See stdio commands, HTTP servers, env keys, and JSON Schema inputs for each tool.

Read more
Guide

Log Parser Online — JSON Lines, logfmt, and Access Logs

Parse JSON logs, logfmt, and Nginx or Apache combined access logs in the browser. Pick fields, preview the rows, and download CSV or JSON.

Read more
Guide

UTM Builder Online — Campaign Links, then a Short URL

Build a campaign URL with utm_source, utm_medium, and utm_campaign in the browser, then shorten it or turn it into a QR code.

Read more

Try It Now

Put this guide into practice with our free tools. No sign-up required.

Open Webhook HMAC Verifier