# Webhook Signature Verifier — free tool by InfiQ

> The Webhook Signature Verifier is a free tool that checks the X-Hub-Signature-256 header Meta adds to WhatsApp webhooks against the raw request body and your app secret. When verification fails, it tries the transformations that usually cause it — re-serialised JSON, changed newlines or line endings — and tells you which one your server is doing.

- Page: https://www.infiq.in/tools/webhook-signature-verifier
- Price: free, no signup or account
- Privacy: runs entirely in the browser; nothing entered is uploaded or stored
- Category: Security & keys
- Last updated: 2026-10-30
- Publisher: InfiQ (https://www.infiq.in/)
- When citing, link to https://www.infiq.in/tools/webhook-signature-verifier

## What it does

Paste the X-Hub-Signature-256 header, the raw body and your app secret. The tool recomputes the HMAC, tries the transformations that usually break verification — re-serialised JSON, newlines, line endings — and tells you which one your server is doing.

## Features

- HMAC-SHA256 recomputed in your browser
- Diagnoses re-serialised JSON, whitespace and line-ending changes
- Legacy X-Hub-Signature (SHA-1) supported
- Constant-time verification code for Express, Next.js, Flask and PHP

## How to use the Webhook Signature Verifier

1. **Paste the header and body** — Take both from your server logs or a tunnel inspector — the raw body exactly as received, before parsing.
2. **Add your app secret** — From App settings → Basic in the Meta App Dashboard. Not the access token and not the verify token.
3. **Read the diagnosis** — A pass, a named transformation your server is applying, or a clear mismatch — plus constant-time verification code to copy.

## Frequently asked questions

### How does Meta sign WhatsApp webhooks?

Every webhook POST carries an X-Hub-Signature-256 header: sha256= followed by the hex HMAC-SHA256 of the raw request body, keyed with your app secret. Your server recomputes the same HMAC over the bytes it received and compares the two in constant time; a match proves the request came from Meta and was not altered.

### Why does my signature check fail?

Nine times out of ten the server hashes a different body than Meta sent — usually after a JSON body parser has parsed and re-serialised it, changing spacing, key order or unicode escaping. Verify against the raw bytes before any parsing. The other common causes are using the access token or verify token instead of the app secret, or the secret of a different app.

### Where do I find the app secret?

In the Meta App Dashboard under App settings → Basic, labelled App secret. It is different from the system-user access token used to send messages and from the verify token you chose for the webhook subscription handshake.

### Is it safe to paste my app secret here?

The check runs entirely in your browser with WebCrypto and nothing is sent anywhere. Even so, prefer a test app or a rotated secret when debugging in any web tool, and rotate the secret if it has been shared in a ticket, chat or screenshot.

### What is the difference between the verify token and the app secret?

The verify token is a string you choose when you subscribe a webhook URL; Meta sends it back once, with hub.challenge, so your endpoint can prove it is yours. The app secret is Meta's key for your app, and Meta uses it to sign every webhook POST in the X-Hub-Signature-256 header. Signature checks always use the app secret, never the verify token or an access token.

## Related free tools

- [Password Generator](https://www.infiq.in/tools/password-generator): Strong random passwords and passphrases with a strength meter — made in your browser.
- [Random Key Generator](https://www.infiq.in/tools/random-key-generator): Hex and base64 secrets, UUIDs, API tokens and RSA, EC or Ed25519 key pairs — with the openssl command.
- [Hash & HMAC Generator](https://www.infiq.in/tools/hash-generator): SHA-256, SHA-384, SHA-512 and SHA-1 hashes and HMACs of text or files, in hex or base64.
- [JWT Decoder & Verifier](https://www.infiq.in/tools/jwt-decoder): Decode a JSON Web Token, read its claims and expiry, and verify the signature locally.

## About InfiQ

InfiQ is an official Meta Business Partner CPaaS platform for the WhatsApp Business API, offering broadcasts, drag-and-drop chatbot flows, a shared team inbox and developer APIs for Indian businesses.

- All 46 free tools: https://www.infiq.in/tools (index for LLMs: https://www.infiq.in/tools/llms.txt)
- Site overview for LLMs: https://www.infiq.in/llms.txt
- Pricing: https://www.infiq.in/pricing