HMAC Webhook Signature Generator and Verifier

How to Use This Tool

Webhook signatures prove that a payload was produced by someone holding the shared secret and that the bytes did not change in transit. Enter the secret and the exact raw request body. The tool imports the secret into the browser's Web Crypto API and signs the UTF-8 payload with HMAC-SHA-256.

Verify before parsing

The most common production bug is parsing JSON and then re-serializing it before verification. Whitespace, key order and line endings can change while the JSON meaning stays identical, producing different bytes and a different HMAC. Capture the raw request body, verify its signature, and only then parse or process the event.

Equivalent JSON objects are not necessarily equivalent byte strings.

Do not copy browser comparison into production

This page can compare text for debugging, but production verification must use a constant-time comparison such as the secure function provided by your runtime. Also reject missing signatures, use the provider's documented header and algorithm, store secrets outside source control, and consider replay protection when the provider supplies delivery IDs or timestamps.

Sources & assumptions

Tool Spec v2 · verified 2026-08-18. Platform rules and fees can change; the editable inputs remain authoritative for your account.

Official references

GitHub Docs — Validating webhook deliveries (checked 2026-08-18)
MDN — SubtleCrypto verify (checked 2026-08-18)

Model assumptions

Secret and payload are interpreted as UTF-8 text; providers that decode hexadecimal or base64 secrets need a different input mode.
Browser comparison helps debugging but production code still needs a constant-time comparison and verification of the raw request bytes.

Frequently Asked Questions

What is an HMAC webhook signature?

It is a keyed digest calculated from a secret and the exact payload bytes. A matching digest supports authenticity and integrity when the secret is protected.

Why does one whitespace change break the signature?

HMAC signs bytes, not the semantic meaning of JSON. One space, line ending or key-order change produces a different digest.

What does the sha256= prefix mean?

GitHub's X-Hub-Signature-256 header prefixes the hexadecimal HMAC with sha256=. Other providers may use another label or encoding.

Can I paste a production secret here?

The static page computes locally, but operational security is still safer with disposable test secrets. Never expose production secrets in screenshots or shared devices.

Is ordinary string equality safe in production?

No. Follow provider guidance and use a constant-time comparison function from your server runtime to reduce timing side channels.

Why does my provider's signature still differ?

Check secret encoding, raw versus parsed body, UTF-8, line endings, prefix removal, hexadecimal versus base64 output and the exact algorithm documented by the provider.

Reproduce a Webhook Signature Without Sending the Secret or Payload Anywhere

How the calculation works