HookCheck

Your webhook signature verification has never been tested.

HookCheck dispatches a suite of cryptographically signed test payloads — tampered bodies, corrupted signatures, expired timestamps, rapid replays — against your receiving endpoint and reports exactly what it accepts that it shouldn’t.

Your secret is used only to sign the test payloads for this run and is never stored.

8 verification vectors, 7 provider standards

Every vector is a deterministic cryptographic assertion about how your endpoint responds. No language model is involved — a passing vector is a fact about your HTTP handler, not an opinion.

Valid Cryptographic Signature

critical

Dispatches authentic payload with exact HMAC SHA256 signature and fresh timestamp.

Expects: HTTP 200/201/202/204

Tampered Payload Body

critical

Dispatches authentic signature calculated over original body, but modifies payload body in-flight.

Expects: HTTP 400/401/403 Rejection

Tampered Signature Header

critical

Dispatches authentic payload with a corrupted / invalid signature hash.

Expects: HTTP 400/401/403 Rejection

Expired Timestamp (Replay Tolerance)

high

Dispatches valid signature with a timestamp 15 minutes (900s) in the past.

Expects: HTTP 400/401/403 Rejection

Future Timestamp (Clock Skew)

medium

Dispatches valid signature with timestamp 10 minutes (600s) in the future.

Expects: HTTP 400/401/403 Rejection

Missing Signature Header

critical

Dispatches authentic JSON body with signature header omitted.

Expects: HTTP 400/401/403 Rejection

Rapid Replay Concurrency

medium

Dispatches two identical webhook deliveries in rapid succession (<50ms) to verify idempotency handling.

Expects: HTTP 200 or 409 (Idempotent)

Malformed JSON Payload

medium

Dispatches truncated/malformed JSON with valid signature to ensure endpoint does not throw unhandled 500 crashes.

Expects: HTTP 400 Bad Request

Supported provider standards

StripeGitHubShopifyResendSvixClerkGeneric HMAC SHA256

Full audit report — $49

The free run above executes the complete vector suite. The paid report adds a signed PDF audit certificate suitable for attaching to a pull request or security review, a permanent shareable URL, and framework-specific remediation code for every failed vector.

  • · All 8 vectors with full request/response traces
  • · Signed PDF audit certificate
  • · Copy-paste fixes for Next.js, Express, and FastAPI
  • · Permanent shareable report URL