Webhook Signature Tester (HMAC)
Generate and verify local HMAC-SHA-256 webhook signatures in generic, Stripe, GitHub, Shopify, or Slack format. Stripe signs timestamp + raw body; Slack signs v0 + timestamp + raw body. Payloads must be valid UTF-8 text smaller than 5,000,000 bytes. Reformatting JSON changes the signature; no request is sent.
About this webhook signature tester (hmac)
Generate and verify local HMAC-SHA-256 webhook signatures in generic, Stripe, GitHub, Shopify, or Slack format. Stripe signs timestamp + raw body; Slack signs v0 + timestamp + raw body. Payloads must be valid UTF-8 text smaller than 5,000,000 bytes. Reformatting JSON changes the signature; no request is sent Validates and converts interface schemas client-side without transmitting private endpoint specifications.
API contract & interface schema logic
Generates and verifies local HMAC-SHA-256 signatures for generic, Stripe, GitHub, Shopify, and Slack formats: Stripe signs timestamp + raw body and emits Stripe-Signature t=...,v1=...; GitHub emits X-Hub-Signature-256 sha256=hex; Shopify emits base64 X-Shopify-Hmac-SHA256; Slack signs v0:timestamp:raw body and emits X-Slack-Signature v0=hex. Payload is valid UTF-8 text strictly below 5,000,000 bytes. Exact raw body text matters; JSON parsing/reformatting changes signed bytes. No request is sent.
Worked schema conversion scenario
Scenario: Compare a supplied HMAC-SHA-256 signature with a local Web Crypto result.
Sample input:
Processing: Imports the supplied secret as HMAC SHA-256, signs the UTF-8 payload, removes an optional sha256= prefix, and compares lowercase hex text.
Illustrative output:
Schema version & syntax constraints
Verification compares a plain hex digest after optional sha256= prefix removal; it does not implement provider-specific canonicalization, timestamp tolerance or replay checks.
API specifications and schema models in Webhook Signature Tester (HMAC) reflect OpenAPI and JSON Schema standards. Verify generated schemas against your runtime validator.
Client-side schema processing boundary
Schema analysis and protocol mapping in Webhook Signature Tester (HMAC) execute locally in the browser tab without uploading endpoint definitions.
OpenAPI Specification & JSON Schema standards
OpenAPI Specification standards and JSON Schema draft definitions:
Webhook Signature Tester (HMAC) verification · Audit standards
How to use it
- Provide payload, secret and supplied signature as JSON or labelled text.
- Compute a local HMAC with Web Crypto and compare its hex digest with the supplied signature.
- Read expected, provided and match fields.
Frequently asked questions
How does Webhook Signature Tester verify a signature?+
The selector supports generic HMAC-SHA-256 and Stripe, GitHub, Shopify, or Slack headers. Stripe signs timestamp + exact raw body; Slack signs v0:timestamp:raw body; GitHub uses sha256=hex; Shopify uses base64. The payload must be valid UTF-8 text under 5,000,000 bytes. JSON reformatting changes the signed bytes.
Can you show an input and its result?+
For payload hello and secret secret, an independently computed Node HMAC-SHA-256 digest was submitted with sha256=. The browser displayed the same expected digest, the normalized provided digest, HMAC-SHA-256, and match: true.
What inputs and algorithms have boundaries?+
All three JSON values are required. The optional algorithm string is passed to Web Crypto as the HMAC hash, so unsupported hash names fail in the browser. The comparison is ordinary text equality and does not claim a timing-safe remote verification protocol.
Does a matching result authenticate a live webhook?+
No. It verifies only the supplied payload and secret inside this page run. It does not receive a provider request, preserve raw transport bytes, validate timestamps or replay protection, inspect provider headers, or prove production secret handling.