00 / free tool
Stripe webhook signature checker (runs in your browser)
Getting No signatures found matching the expected signature for payload? Paste what your server got. We redo Stripe's check and tell you which part is off.
01 / check a signature
Exactly as your server got it. Log it with await req.text() before any JSON parsing.
It stays in this tab. Nothing is sent or saved. Use a test-mode secret if you can, and roll any secret you paste somewhere you don't trust.
02 / how it works
a
Same math as Stripe
We read t and every v1 from the header, build t.body, and compute an HMAC-SHA256 with your secret. If one v1 matches, the signature is valid. Stripe: verify signatures manually
b
If it doesn't match
We try the changes frameworks often make to a body: other line breaks, a trailing newline, compact or pretty JSON. If one of those matches, your body was changed before you checked it. We also flag a secret with spaces, quotes, or an API key in its place. Stripe: resolve signature errors
c
Fix it in code
Our guide shows the raw-body fix for Next.js, Express and Supabase. Signature verification failed in Next.js
03 / questions
- Is it safe to paste my webhook secret here?
- The check runs in your browser with the Web Crypto API. The page makes no request with what you type and saves nothing. Still, use a test-mode secret when you can, and roll any secret you've pasted somewhere you don't trust.
- How does Stripe sign webhooks?
- Stripe puts a timestamp (t) and one or more v1 signatures in the Stripe-Signature header. Each v1 is an HMAC-SHA256 of the timestamp, a dot, and the raw body, keyed with your endpoint's signing secret.
- Why does verification fail when the secret is right?
- Usually the body was changed before verification: parsed as JSON and turned back into a string, or re-encoded. Verify the raw body. In Next.js App Router, read it with await req.text().
- What does 'Timestamp outside the tolerance zone' mean?
- The signature matched but is older than allowed. Stripe's libraries allow 5 minutes by default. Retries get a new timestamp and signature, so resend the event instead of replaying a saved request.
- Which secret do I use with stripe listen?
- The one stripe listen prints. It is different from the secret of the endpoint in the Dashboard, and test and live endpoints have different secrets too.
04 / catch it next time
A failed signature check means your handler answers 400 and Stripe marks the delivery failed. CheckoutAlarm reads your Stripe account with a read-only key and emails you when events are still undelivered after about 15 minutes, so you hear before customers do.
Free: 1 site, checked once a day. Pro: $19 a month for up to 3 sites, checked hourly. We only check sites you prove you own, and for Stripe we only take a read-only restricted key. Compare plans
Watch my app freeFree for one app. Checked every day. No card needed.
05 / more free tools
- Stripe webhook error decoderPaste a webhook error or an Event deliveries status (400, 401, 307, timed out). Get what it means and the fix.
- Webhook outage cost calculatorHow much money passed through while your webhook was broken, what Stripe will still retry, and whether a quiet spell in sales is normal.