Webhook Signature Verifier
Verify webhook signatures from Stripe, Adyen, Checkout.com, and Braintree. Confirms a payload was signed with your secret and hasn't been tampered with — all HMAC runs in your browser, nothing is sent anywhere.
Follows Stripe / Adyen / Checkout.com / Braintree webhook signingStripe v1 · Adyen standard-notification HMAC · Cko-Signature · Braintree bt_signature·verified Oct 2026· double-checked Oct 2026— verdicts match the official Stripe (node, python, java, go, ruby, php), Adyen (node, python, java, php) and Braintree (node, python, java, ruby, php) libraries and Checkout.com’s own plugin on ~23,000 cases; library differences are named
Stripe signs the raw body prefixed with a timestamp. Paste the full Stripe-Signature header value (t=…,v1=…) below.
signed_payload = "{timestamp}.{raw_body}" // t from the header, raw bytes of the body
expected = HMAC_SHA256(key = whsec_secret, msg = signed_payload) // lowercase hex
// the key is the whole "whsec_…" string as UTF-8 — not base64-decoded
Accept if ANY v1 entry equals expected (several are sent while a secret is rolled);
compare in constant time. v0 entries are fake-secret test-mode signatures: ignore them.
Reject if now - timestamp > tolerance (default 300 s).
The official libraries differ on malformed or unusual headers; this tool follows
stripe-node / stripe-python:
spaces after "," accepted by ruby, php, .NET — rejected by node, python, java, go
uppercase v1 hex accepted by go (hex-decodes) — rejected by node, python, java, ruby, php, .NET
future timestamp rejected beyond the tolerance by php, .NET (|now - t|) — accepted by the rest
two t= entries node, go use the last — python, java, ruby, php, .NET the first