Webhook Signature Tester (HMAC)
Webhook Signature Tester (HMAC): Computes HMAC-SHA256 digest of payload using Web Crypto API and formats hex signature.
About this webhook signature tester (hmac)
Webhook Signature Tester (HMAC) — browser-based utility.
How this tool works
Implements client-side Webhook Signature Tester (HMAC) operations. Computes HMAC-SHA256 digest of payload using Web Crypto API and formats hex signature specifically designed for a developer verifies a stripe or github webhook hmac-sha256 signature locally in the browser.
- Credential & Payload Ingestion: Accepts raw request body strings, timestamp headers, and shared signing secrets.
- Canonical String Construction: Assembles the canonical signing payload (e.g. timestamp + '.' + body for Stripe signatures).
- Cryptographic Hash Evaluation: Uses Web Crypto subtle.sign with HMAC-SHA256 to compute the reference digest.
- Constant-Time Verification: Compares computed signature against received header using constant-time byte iteration.
Worked example
Scenario: A developer verifies a Stripe or GitHub webhook HMAC-SHA256 signature locally in the browser.
Sample input:
Processing: Computes HMAC-SHA256 digest of payload using Web Crypto API and formats hex signature.
Illustrative output:
Limits and verification
Requires exact raw byte representations of JSON bodies; any whitespace formatting change invalidates cryptographic HMAC signatures. Flags timestamp drift exceeding 5 minutes (300 seconds) to prevent replay attacks.
Examples demonstrate an expected workflow; they do not prove every input or every branch of an external specification. Check important results with an independent source before using them for money, security, compliance, safety, or irreversible file changes.
Browser processing boundary
Tool input is processed by code running in the browser and is not intentionally sent to a CZOA processing API. The page can still request ordinary site assets, analytics, or advertising when those services are enabled. Browser extensions and managed-device software remain outside this tool's control.
Relevant references
These references govern or help explain the format, protocol, or calculation used here. Listing a reference does not claim certification or complete implementation of every optional feature.
Content owner: CZOA Tools · Last reviewed: 2026-09-15 · Review methodology
How to use it
- Enter, paste, or select your input data into the Webhook Signature Tester (HMAC) workspace controls.
- Review available parameter fields, units, formats, or options configured for your task.
- Click the action button or observe immediate live calculations rendered in your browser runtime.
- Inspect the resulting output and any diagnostic messages, then copy or download the result if needed.
Frequently asked questions
How does Webhook Signature Tester verify a signature?+
It accepts JSON containing payload, secret and signature, imports the secret into the browser Web Crypto HMAC API, signs the UTF-8 payload with SHA-256 by default, hex-encodes the result, removes an optional sha256= prefix from the supplied value, and compares lowercase text.
What did the webhook fixture verify?+
For payload hello and secret secret, an independently computed Node HMAC-SHA-256 digest was submitted with sha256=. The browser displayed the same expected digest, the normalized provided digest, HMAC-SHA-256, and match: true.
What inputs and algorithms have boundaries?+
All three JSON values are required. The optional algorithm string is passed to Web Crypto as the HMAC hash, so unsupported hash names fail in the browser. The comparison is ordinary text equality and does not claim a timing-safe remote verification protocol.
Does a matching result authenticate a live webhook?+
No. It verifies only the supplied payload and secret inside this page run. It does not receive a provider request, preserve raw transport bytes, validate timestamps or replay protection, inspect provider headers, or prove production secret handling.