Webhook signature validator.
Paste a webhook payload, your signing secret and the signature you received. This computes the HMAC (SHA-256 or SHA-1) with the Web Crypto API and tells you whether it matches. Generic — works for any HMAC-signed webhook. Nothing leaves your device.
Use the exact bytes as received — re-serialising JSON changes the hash.
Computed the HMAC below. Paste a signature to verify it matches.
Everything runs locally via the Web Crypto API — the payload and secret never leave this page. Prefer a test secret over a live production secret in any online tool.
The short answer
What is a webhook signature?
A webhook signature is a keyed hash — an HMAC — of the request body, computed by the sender with a secret both parties share and sent alongside the request, usually in a header. To verify it, you recompute the HMAC over the exact raw body with the same secret and algorithm and compare. A match proves the payload came from someone holding the secret and was not altered in transit. It authenticates and protects integrity — it does not encrypt the payload.
How to verify a signature correctly
- Capture the raw request body before any parsing. JSON re-serialisation reorders keys and whitespace, which changes the hash.
- Run HMAC with the shared secret and the sender's hash function (SHA-256 for most modern APIs).
- Hex-encode the result and compare it to the signature header, ignoring any scheme prefix like sha256=.
- In production, compare with a constant-time equality function to avoid timing side channels, and reject stale requests using the timestamp the provider signs.
Frequently asked questions
What is a webhook signature?
A webhook signature is a keyed hash (HMAC) of the request body, computed by the sender with a shared secret and sent in a header. The receiver recomputes the HMAC over the exact raw body with the same secret and compares — if they match, the payload is authentic and unmodified. It proves origin and integrity without encrypting the payload.
How do I verify an HMAC webhook signature?
Take the exact raw request body (before any JSON parsing or re-serialisation), run HMAC with your shared secret and the sender's hash algorithm (usually SHA-256), and hex-encode the result. Compare it to the signature header, ignoring any prefix such as 'sha256='. If they are equal, the signature is valid.
Why does my signature not match?
The usual causes are: the body was re-serialised so it differs byte-for-byte from what was signed; the wrong secret or hash algorithm; the provider signs a string that also includes a timestamp or version prefix; or a hex-versus-base64 encoding mismatch. Always hash the raw bytes exactly as received.
Is it safe to paste a real secret here?
The computation runs entirely in your browser using the Web Crypto API — nothing is uploaded or logged. As a general habit, still prefer a test secret over a live production secret in any online tool, and rotate a secret you suspect has been exposed.
Should I use SHA-256 or SHA-1?
Use HMAC-SHA-256. SHA-1 is offered here only because some legacy providers still send SHA-1 signatures. New integrations should standardise on SHA-256.
Does the signature encrypt my payload?
No. An HMAC signature authenticates the payload and proves it was not tampered with, but the body is still sent in the clear. Use HTTPS (TLS) for confidentiality; the signature is about origin and integrity, not secrecy.
Why compare in constant time in production?
A naive string comparison can leak how many leading characters matched through tiny timing differences, which an attacker could exploit to forge a signature. In production, compare with a constant-time function such as crypto.timingSafeEqual. This browser tool compares directly because there is no remote attacker to time.
Verify any HMAC-signed webhook.
This validator works with any provider that signs webhooks with HMAC. When you're ready to build, BroadNet offers a Bearer-token REST API, delivery-report webhooks and direct SMPP 3.4 binds.