Calculate and verify webhook HMAC signatures for Stripe, GitHub, Shopify, and other popular webhook providers.
This tool reproduces the HMAC signature that Stripe, GitHub, and Shopify attach to outgoing webhook requests, so you can confirm a payload matches its signature without waiting for the provider to redeliver a real event. You enter the raw request body, the signing secret, and (for Stripe) the timestamp from the signature header; the tool recomputes the digest and reports a match or mismatch. The detail people miss most: signatures are computed over the exact raw bytes of the body, so re-indenting or re-formatting JSON before pasting it in silently breaks the match.
A concrete input and expected output from the current implementation.
Input
Provider: GitHub | Secret: Jefe | Raw payload body: what do ya want for nothing?
Expected output
sha256=5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
GitHub's X-Hub-Signature-256 header is the hex HMAC-SHA256 digest of the exact secret and raw body, prefixed with sha256=; this secret/body pair is the standard HMAC-SHA256 test vector from RFC 4231 Test Case 2, so the digest is independently verifiable.
Each provider builds its signed string differently. GitHub and Shopify HMAC the raw request body directly, GitHub reporting SHA-256 as hex, Shopify as base64; Stripe instead signs a string built as timestamp.raw_body and reports it in a Stripe-Signature header as t=...,v1=.... The tool switches which construction it uses based on the provider you pick.
Given a secret, a payload, and (for Stripe) a timestamp, the tool computes HMAC-SHA256 and displays the result in the provider's native encoding. If you also paste in a signature you received, it compares the two byte-for-byte and reports a match or mismatch rather than just showing a raw digest for you to eyeball.
It proves the payload and secret you entered reproduce the exact digest shown. If that digest equals the one the provider sent, the request came from someone holding that secret and the body wasn't altered in transit. It does not confirm your server's own comparison code is implemented correctly.
No - the HMAC computation runs entirely in your browser, so the secret and payload you type never leave the page. That matters because a webhook signing secret functions like a password: anyone who has it can forge events that your endpoint will accept as genuine.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.