Logit

Tools / Webhook Signature Verifier

Webhook Signature Verifier

Verify HMAC-SHA256 webhook signatures from Stripe, GitHub, or any provider. Everything runs in your browser — no data is sent to a server.

Provider

Stripe sends Stripe-Signature header. Extract the `t=` timestamp and `v1=` signature.

Raw Payload Body

Timestamp (t= from Stripe-Signature header)

Webhook Secret

v1= Signature (from Stripe-Signature header)

Log Webhook Verification Failures

// In your webhook handler
if (!isValidSignature) {
  await logit.now("security", {
    event: "Webhook signature failed",
    description: "Invalid signature — possible replay attack",
    icon: "🚨",
    notify: true,
    metadata: { provider: "stripe", ip: req.ip },
  });
  return res.status(400).send("Invalid signature");
}

Get alerted on webhook failures

LogIt notifies you instantly when webhooks fail or signatures mismatch. Free trial.

Start free