Browser-only developer tool

Stripe Webhook Signature Verifier

Secrets and payloads never leave your browser. Verification uses Web Crypto locally. Inputs are not saved in URLs or browser storage. No analytics runs on these tool pages.

Nothing is trimmed, parsed as JSON, or URL-decoded. Empty bodies are supported. Paste only header values, without header names.

How Stripe signs webhooks

timestamp.raw_body → HMAC-SHA256 → hex (v1=)

Use the full whsec_ endpoint secret as UTF-8 text. Do not base64-decode it. CLI and Dashboard endpoints have different secrets. Paste the full t=…,v1=… header; multiple v1 signatures support rotation.

Common mistakes

  • Verify the raw request body before JSON parsing. Whitespace, field order, Unicode and trailing newlines change the signature.
  • Text entry uses UTF-8; browsers may normalize pasted CRLF to LF. For byte-exact binary or CRLF payloads, choose base64 raw bytes.
  • Signatures establish authenticity, not uniqueness. Your receiver must still deduplicate deliveries and enforce its own replay policy.
  • This is a debugging tool, not a replacement for server-side verification. Prefer synthetic fixtures when possible and clear sensitive input when finished.

Webhook signature verification guide · Stripe testing guide · Official Stripe signing reference