Verify HMAC Signatures Online
Generate an HMAC-SHA256 signature, compare it with a webhook header, and debug mismatches entirely in your browser.
Paste an existing signature to compare it with the computed result above.
Why HMAC?
Webhook providers such as Telegram, WhatsApp, Stripe, and GitHub sign requests with a shared secret. Your server computes the HMAC over the same raw payload and compares the result with the signature header. This tool reproduces that calculation without sending the payload or secret to a server. For production handlers, follow the webhook delivery and signature verification guide.
When to use this verifier
Use it when a mismatch may come from the wrong secret, a modified JSON body, a missing timestamp prefix, the wrong hash algorithm, or a hex/base64 encoding difference. Always paste the exact raw payload bytes captured by the receiver.
FAQ
- What is HMAC?
- HMAC combines a cryptographic hash function with a shared secret to prove that a sender knows the secret without transmitting it.
- How is HMAC used for webhooks?
- The provider signs the raw request body, and your server recomputes the signature using the same secret before accepting the request.
- How do I verify a signature?
- Use the exact raw payload, secret, algorithm, and output encoding used by the provider, then compare the values with a constant-time function in production.
- Does my data leave the browser?
- No. The Web Crypto API performs the calculation locally; the payload and secret are not uploaded.
- Which algorithms are supported?
- SHA-1, SHA-256, and SHA-512. SHA-256 is the most common choice for modern webhook signatures.