All Tools

WhatsApp Webhook Signature Verifier

Compute the X-Hub-Signature-256 HMAC-SHA256 header for a webhook payload, and check it against the one WhatsApp actually sent.

Everything below runs locally with your browser's Web Crypto API. Your app secret is never sent over the network or stored — it exists only in this page's memory until you reload.

Found in your Meta App Dashboard under Settings → Basic. WhatsApp uses this to sign every webhook request body.

Must match byte-for-byte what your server received — re-serialized/pretty-printed JSON will produce a different signature.

Enter an app secret to compute a signature…
Paste the header your server received to check it against the computed signature.

Verify It Server-Side (Node.js)

This page is for debugging. In production, verify signatures on your server using a constant-time comparison, on the raw (unparsed) request body:

const crypto = require('crypto')

function isValidSignature(rawBody, signatureHeader, appSecret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', appSecret)
    .update(rawBody)
    .digest('hex')

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signatureHeader)
  )
}

Handling Verified Webhooks Programmatically

Once inbound messages are verified, reply to them or trigger automations through a simple REST API — no server-side WhatsApp client to maintain.

Try Free on RapidAPI →