Free tool· Security & keys
Find out why your WhatsApp webhook signature won't verify
Paste the X-Hub-Signature-256 header, the raw body and your app secret. The tool recomputes the HMAC, tries the transformations that usually break verification — re-serialised JSON, newlines, line endings — and tells you which one your server is doing.
- Runs in your browser
- Free, no signup
- Updated
What Meta sent
Copy it from your server logs before any JSON parsing — every byte, space and newline counts.
Your app secret
Meta App Dashboard → App settings → Basic → App secret. Not the access token, not the verify token.
Verdict
Waiting for all three inputs
Verify it in your code
import crypto from "node:crypto";
import express from "express";
const app = express();
// Keep the raw bytes: verification must hash exactly what Meta sent.
app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
const header = req.get("x-hub-signature-256") ?? "";
const expected =
"sha256=" +
crypto
.createHmac("sha256", process.env.META_APP_SECRET)
.update(req.body) // a Buffer, not parsed JSON
.digest("hex");
const ok =
header.length === expected.length &&
crypto.timingSafeEqual(Buffer.from(header), Buffer.from(expected));
if (!ok) return res.sendStatus(401);
const payload = JSON.parse(req.body.toString("utf8"));
// …handle payload…
res.sendStatus(200);
});Compare with a constant-time function, answer 200 quickly, and do heavy work after responding — Meta retries webhooks that time out. Decode payloads with the webhook payload formatter.
About this tool
What is the Webhook Signature Verifier?
The Webhook Signature Verifier is a free tool that checks the X-Hub-Signature-256 header Meta adds to WhatsApp webhooks against the raw request body and your app secret. When verification fails, it tries the transformations that usually cause it — re-serialised JSON, changed newlines or line endings — and tells you which one your server is doing.
- Price
- Free
- Signup
- None
- Your data
- Stays in your browser
- Updated
What you get
- HMAC-SHA256 recomputed in your browser
- Diagnoses re-serialised JSON, whitespace and line-ending changes
- Legacy X-Hub-Signature (SHA-1) supported
- Constant-time verification code for Express, Next.js, Flask and PHP
Security & keys · no account, nothing uploaded
How it works · three steps, no signup
How to use the Webhook Signature Verifier
Step 1: Paste the header and body
Take both from your server logs or a tunnel inspector — the raw body exactly as received, before parsing.
Step 2: Add your app secret
From App settings → Basic in the Meta App Dashboard. Not the access token and not the verify token.
Step 3: Read the diagnosis
A pass, a named transformation your server is applying, or a clear mismatch — plus constant-time verification code to copy.
FAQ
Webhook Signature Verifier: questions and answers
How does Meta sign WhatsApp webhooks?
Every webhook POST carries an X-Hub-Signature-256 header: sha256= followed by the hex HMAC-SHA256 of the raw request body, keyed with your app secret. Your server recomputes the same HMAC over the bytes it received and compares the two in constant time; a match proves the request came from Meta and was not altered.
Why does my signature check fail?
Nine times out of ten the server hashes a different body than Meta sent — usually after a JSON body parser has parsed and re-serialised it, changing spacing, key order or unicode escaping. Verify against the raw bytes before any parsing. The other common causes are using the access token or verify token instead of the app secret, or the secret of a different app.
Where do I find the app secret?
In the Meta App Dashboard under App settings → Basic, labelled App secret. It is different from the system-user access token used to send messages and from the verify token you chose for the webhook subscription handshake.
Is it safe to paste my app secret here?
The check runs entirely in your browser with WebCrypto and nothing is sent anywhere. Even so, prefer a test app or a rotated secret when debugging in any web tool, and rotate the secret if it has been shared in a ticket, chat or screenshot.
What is the difference between the verify token and the app secret?
The verify token is a string you choose when you subscribe a webhook URL; Meta sends it back once, with hub.challenge, so your endpoint can prove it is yours. The app secret is Meta's key for your app, and Meta uses it to sign every webhook POST in the X-Hub-Signature-256 header. Signature checks always use the app secret, never the verify token or an access token.
Still have questions?
Book a demoMore free tools
Keep your stack sharp
Ready to do this at scale?
InfiQ puts broadcasts, chatbots, a shared inbox and the developer API behind one dashboard — on the official WhatsApp Business API. 7-day free trial, no card required.