# Webhook signature validator.

- Canonical URL: https://www.broadnet.me/tools/webhook-signature-validator
- Language: en
- Last updated: 2026-10-21
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

HMAC · Web Crypto · runs in your browser

Paste a webhook payload, your signing secret and the signature you received. This computes the HMAC (SHA-256 or SHA-1) with the Web Crypto API and tells you whether it matches. Generic — works for any HMAC-signed webhook. Nothing leaves your device.

Use the exact bytes as received — re-serialising JSON changes the hash.

Algorithm

Verification

Computed the HMAC below. Paste a signature to verify it matches.

Computed HMAC-SHA-256 (hex)

Computing in your browser…

Everything runs locally via the Web Crypto API — the payload and secret never leave this page. Prefer a test secret over a live production secret in any online tool.

The short answer

## What is a webhook signature?

A webhook signature is a keyed hash — an **HMAC** — of the request body, computed by the sender with a secret both parties share and sent alongside the request, usually in a header. To verify it, you recompute the HMAC over the exact raw body with the same secret and algorithm and compare. A match proves the payload came from someone holding the secret and was not altered in transit. It authenticates and protects integrity — it does not encrypt the payload.

### How to verify a signature correctly

1. Capture the **raw request body** before any parsing. JSON re-serialisation reorders keys and whitespace, which changes the hash.
2. Run HMAC with the shared secret and the sender's hash function (SHA-256 for most modern APIs).
3. Hex-encode the result and compare it to the signature header, ignoring any scheme prefix like sha256=.
4. In production, compare with a **constant-time** equality function to avoid timing side channels, and reject stale requests using the timestamp the provider signs.

## Frequently asked questions

**What is a webhook signature?**

A webhook signature is a keyed hash (HMAC) of the request body, computed by the sender with a shared secret and sent in a header. The receiver recomputes the HMAC over the exact raw body with the same secret and compares — if they match, the payload is authentic and unmodified. It proves origin and integrity without encrypting the payload.

**How do I verify an HMAC webhook signature?**

Take the exact raw request body (before any JSON parsing or re-serialisation), run HMAC with your shared secret and the sender's hash algorithm (usually SHA-256), and hex-encode the result. Compare it to the signature header, ignoring any prefix such as 'sha256='. If they are equal, the signature is valid.

**Why does my signature not match?**

The usual causes are: the body was re-serialised so it differs byte-for-byte from what was signed; the wrong secret or hash algorithm; the provider signs a string that also includes a timestamp or version prefix; or a hex-versus-base64 encoding mismatch. Always hash the raw bytes exactly as received.

**Is it safe to paste a real secret here?**

The computation runs entirely in your browser using the Web Crypto API — nothing is uploaded or logged. As a general habit, still prefer a test secret over a live production secret in any online tool, and rotate a secret you suspect has been exposed.

**Should I use SHA-256 or SHA-1?**

Use HMAC-SHA-256. SHA-1 is offered here only because some legacy providers still send SHA-1 signatures. New integrations should standardise on SHA-256.

**Does the signature encrypt my payload?**

No. An HMAC signature authenticates the payload and proves it was not tampered with, but the body is still sent in the clear. Use HTTPS (TLS) for confidentiality; the signature is about origin and integrity, not secrecy.

**Why compare in constant time in production?**

A naive string comparison can leak how many leading characters matched through tiny timing differences, which an attacker could exploit to forge a signature. In production, compare with a constant-time function such as crypto.timingSafeEqual. This browser tool compares directly because there is no remote attacker to time.

[SMS API REST + SMPP 3.4, Bearer-token auth, delivery webhooks.](https://www.broadnet.me/products/sms-api) [SMSC Gateway Carrier-grade SMSC over SMPP + SS7.](https://www.broadnet.me/operators/smsc-gateway) [Developer hub Quickstart, TypeScript SDK, references and tools.](https://www.broadnet.me/developers)

## Verify any HMAC-signed webhook.

This validator works with any provider that signs webhooks with HMAC. When you're ready to build, BroadNet offers a Bearer-token REST API, delivery-report webhooks and direct SMPP 3.4 binds.

[Developer hub](https://www.broadnet.me/developers) [SMS API](https://www.broadnet.me/products/sms-api)