Free tool · All tools
Prove the webhook is real.
Sign a payload or verify a received HMAC-SHA256 signature — locally in your browser, in the same timestamped v1 format signed result webhooks deliver.
Everything runs in your browser with WebCrypto. Secrets, payloads, and signatures never leave this page.
Computed signature
Enter a signing secret to compute the HMAC-SHA256 signature.
Receivers of the v1 scheme should also reject timestamps outside a short replay window; this tester checks the signature only.
Questions
What is an HMAC-SHA256 webhook signature?
The sender computes an HMAC-SHA256 digest of the payload with a shared secret and sends it alongside the request. The receiver recomputes the digest from the raw body it received; a match proves the payload came from someone holding the secret and arrived unaltered.
What exactly does the timestamped v1 scheme sign?
The Unix-seconds timestamp and the raw request body, joined by a single dot — then the hex digest is prefixed with v1=. Signing the timestamp binds the signature to a moment in time, which is what makes replay detection possible.
Why should receivers also check the timestamp?
A valid signature can be replayed unchanged, so receivers should also reject deliveries whose timestamp falls outside a short window. This tester checks the signature itself; the replay window is the receiver's job.
Is my signing secret sent to a server?
No. Signing runs through your browser's WebCrypto API on this page. The secret, payload, and computed signature are never transmitted anywhere.
Start with Free