Why should I use the raw payload when calculating webhook HMACs?

HMAC signatures rely on byte-for-byte exact matches of the request body. Formatting or re-ordering JSON fields changes the hash output and fails verification.

Is my signing secret safe?

Yes! Cryptographic HMAC signatures are calculated 100% locally in your browser memory using Web Crypto API. Secret keys are never sent across the network.

HMAC Signature & Webhook Verifier

100% Client-Side Private — Zero Server Uploads

Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, ZaloPay, MoMo webhook verification. 100% Client-Side Web Crypto API.

Algorithm:

Format:

Secret Key / Signing Secret

Message Payload / Webhook Raw Body

{
  "event": "payment.succeeded",
  "amount": 4900,
  "currency": "usd",
  "customer": "cus_N123456789"
}

Calculated HMAC Signature (SHA-256 / HEX)

Enter secret key to compute signature...

Verify Webhook Signature (Optional)

How do I use HMAC Signature & Webhook Verifier?

Enter your secret key / signing secret.

Paste the raw request payload or JSON message body.

Choose HMAC hash algorithm (SHA-256, SHA-512) and encoding format.

Copy signature or paste header signature to verify authenticity.

What features does HMAC Signature & Webhook Verifier offer?

Browser native Web Crypto API (fast & secure)

Stripe, GitHub, Shopify webhook support

Hex and Base64 output encoding

Frequently Asked Questions about HMAC Signature & Webhook Verifier

Why should I use raw body for webhook verification?

HMAC signatures depend on exact byte-for-byte matching of the payload. Re-formatting JSON will break signature verification.

Advertisement728×90 Leaderboard