Compute and verify HMAC signatures for webhook payloads. Supports Stripe, GitHub, Shopify formats. All crypto runs in your browser.
Webhook signatures are cryptographic hashes that prove a webhook payload was sent by the claimed provider and has not been tampered with in transit. When a provider like Stripe, GitHub, or Shopify sends a webhook, it computes an HMAC (Hash-based Message Authentication Code) using a shared secret key and the raw request body. The resulting signature is attached as an HTTP header — for example, Stripe-Signature, X-Hub-Signature-256, or X-Shopify-Hmac-SHA256.
To verify a webhook, your server recomputes the HMAC using the same shared secret and the raw payload bytes it received. If the computed signature matches the one in the header, you can be confident the payload is authentic and unmodified. This is critical for security: without signature verification, an attacker could forge webhook events to trigger actions in your system — such as marking fake payments as complete or creating unauthorized accounts.
The most common algorithm is HMAC-SHA256, which combines the SHA-256 hash function with a secret key to produce a 64-character hexadecimal digest. Some providers (like older GitHub webhooks) use HMAC-SHA1, while others may use HMAC-SHA512 for extra strength. The choice of algorithm does not affect the verification flow — only the hash function changes. Always use a timing-safe comparison when checking signatures server-side to prevent timing attacks.
This tool lets you generate and verify HMAC signatures entirely in your browser using the Web Crypto API. No payload data is transmitted to any server. It supports Stripe's t=timestamp,v1=signature format, GitHub's sha256=signature prefix format, and Shopify's Base64-encoded HMAC. Use it to debug webhook integrations, test signature logic before deploying, or verify that incoming webhooks match your expected secret key.