Stripe Webhook Signature Verifier & Tester (`Stripe-Signature: t,v1`)
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Verify Received Stripe-Signature Header
How do I use Stripe Webhook Signature Verifier & Tester (`Stripe-Signature: t,v1`)?
Notice the tool is pre-configured to 'Stripe (t,v1)' mode with a sample `checkout.session.completed` event payload, `whsec_...` secret, and `t=1710864000` timestamp.
Paste your endpoint's Signing Secret (`whsec_...`), Unix timestamp (`t=`), and exact raw JSON request body.
Copy the generated `Stripe-Signature: t=...,v1=...` header value to test your webhook endpoint in Postman, cURL, or Vitest.
Or paste a received `Stripe-Signature` header into the Verifier input at the bottom to check if your payload and secret match.
What features does Stripe Webhook Signature Verifier & Tester (`Stripe-Signature: t,v1`) offer?
Pre-configured for Stripe's exact `${timestamp}.${raw_payload}` signed payload construction
Outputs the full `t=1710864000,v1=...` `Stripe-Signature` HTTP header plus the raw hex digest
Pre-loaded with a realistic `checkout.session.completed` Stripe event (`evt_1P6xYz...`) and `whsec_` test secret
Instant verification box accepts either the full `t=...,v1=...` header or the standalone `v1` hex signature
Helps debug `No signatures found matching the expected signature for payload` errors in Next.js & Express
100% Client-Side Web Crypto API: live `whsec_` signing secrets never leave your browser
How Stripe Computes the `Stripe-Signature` (`t=...,v1=...`) Header
Unlike generic webhooks that hash only the JSON body, Stripe prepends the Unix timestamp (`t`) and a literal period (`.`) before computing HMAC-SHA256 to prevent replay attacks.
signed_payload = `${timestamp}.${raw_http_body}`The Unix timestamp from `t=` and the exact UTF-8 request body are joined by a `.` character before hashing.
v1 = HMAC_SHA256_HEX(whsec_secret, signed_payload)Stripe transmits `Stripe-Signature: t=<timestamp>,v1=<hex_digest>`. (The `whsec_` prefix is part of the ASCII secret string).
| Header Element | Format / Example | Cryptographic Role | Stripe SDK Verification Rule |
|---|---|---|---|
| Timestamp (t) | t=1710864000 | Unix epoch seconds when Stripe sent event | Default 300s (5 min) replay tolerance |
| Live/Test Signature (v1) | v1=5257a869e7ecebeda32... | HMAC-SHA256 hex digest of t.body | Compared via constant-time crypto.timingSafeEqual |
| Legacy Test Signature (v0) | v0=6ffbb59b2300aae63f2... | Deprecated schema signature | Ignored by modern stripe.webhooks.constructEvent |
| Signing Secret | whsec_... | Endpoint-specific shared HMAC key | Distinct per webhook URL & Stripe CLI session |
How is Stripe Webhook Signature Verifier & Tester (`Stripe-Signature: t,v1`) used in real-world workflows?
Debugging `No signatures found matching the expected signature` Errors
If `await req.json()` was called instead of `await req.text()`, key ordering or whitespace changes break the HMAC. Paste your raw body here to verify the exact `v1` digest.
Generating Valid `Stripe-Signature` Headers for Postman & Integration Tests
Compute a valid `t=...,v1=...` header for custom mock `invoice.payment_failed` or `customer.subscription.deleted` payloads.
Verifying Production vs. Stripe CLI `whsec_` Secret Mismatches
Confirm whether a failed webhook was signed with the Stripe Dashboard endpoint secret or the local `stripe listen` CLI secret.
Frequently Asked Questions about Stripe Webhook Signature Verifier & Tester (`Stripe-Signature: t,v1`)
Why does `stripe.webhooks.constructEvent` fail in Next.js or Express?
In 99% of cases, middleware (`express.json()`) or `await req.json()` parsed and re-serialized the JSON body before passing it to `constructEvent()`, altering whitespace or key formatting. In Next.js App Router, always pass `const rawBody = await request.text()` directly to `stripe.webhooks.constructEvent(rawBody, sig, secret)`.
Why does my Stripe signature not match if I only hash the JSON body?
Stripe does not hash the JSON body alone. Stripe hashes the concatenated string `${timestamp}.${raw_body}` (the `t=` Unix timestamp, a literal dot `.`, and the raw payload) using HMAC-SHA256 in lowercase hex.
Do I strip the `whsec_` prefix from my Stripe signing secret?
No! Keep the full `whsec_...` string intact when computing the HMAC-SHA256 signature—Stripe's signing key is the full ASCII string including `whsec_`.
Is it safe to paste my `whsec_` secret into this verifier?
Yes. All HMAC calculations use your browser's built-in `window.crypto.subtle` Web Crypto API. Zero data is transmitted over the network.
Explore Related Developer Tools
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.
JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.