Webhook Signature Checker
Body, signature header and secret in; a match verdict and the likely mistake out.
Computed in your browser with Web Crypto. Nothing is sent. Prefer a test secret.
How it works, provider coverage and FAQBackground readingWebhook signaturesHMAC
How the checker works
Verify mode rebuilds the exact signed string and compares in constant time. On a mismatch it retries the common mistakes (re-serialized JSON, newlines, whsec_ prefix, base64 versus hex, seconds versus milliseconds).
Public-key vendors are checked with RSA, RSA-PSS, ECDSA or Ed25519. Sign mode builds test headers and a curl command.
Signing schemes
Stablecoin payments vendors
Webhook signature FAQ
Why does my webhook signature not match?
Usually the framework parsed and re-serialized the JSON before you verified it. Sign and compare the raw bytes; then check the secret, trailing newlines and hex versus base64.
Is it safe to paste my webhook secret here?
The HMAC is computed in your browser and nothing is sent. Still prefer a test secret, and roll any secret pasted into a shared machine or chat.
Why check the timestamp as well as the signature?
A signed request can be replayed. Reject requests older than a few minutes and dedupe on the event id.
Should I compare signatures with ===?
No. Use crypto.timingSafeEqual in Node or hmac.compare_digest in Python, after checking the lengths match.
How do I verify a webhook signed with a public key?
Verify the raw bytes with the vendor's public key: RSA for Bridge and Zero Hash, ECDSA for Circle and Noah, Ed25519 for Due.
Signing schemes follow each provider's webhook documentation as of October 2026. Where a provider ships an SDK verifier, use it in production; the code here shows what it does.