All tools

HMAC Signature Workbench

Compute and verify HMAC-SHA256/512/1 signatures for webhook debugging — hex, Base64, timing-safe compare.

Crypto & Certs
Privacy: 100% Client-Side. Your data never leaves this browser tab. Processing uses Web APIs and client-side libraries only.

Compute and verify HMAC signatures for webhook debugging (GitHub, Stripe, Shopify, Twilio). Timing-safe comparison runs entirely in your browser via WebCrypto.

GitHub, Stripe, Shopify default

What is HMAC verification?

HMAC (Hash-based Message Authentication Code) signs a payload with a shared secret so receivers can prove authenticity and integrity. Webhook providers like GitHub and Stripe send an HMAC of the raw body that your server must recompute and compare.

This workbench uses WebCrypto to compute HMAC-SHA1/256/512 locally and performs a timing-safe byte comparison against an expected signature — without sending your secret to stbox servers.

How to use this tool

  1. Paste the raw webhook body and shared secret, pick an algorithm, and click Compute.
  2. Compare hex / Base64 / Base64URL outputs side by side.
  3. Optionally paste the provider's signature and Verify with timing-safe equality.

Frequently asked questions

Is my webhook secret uploaded?

No. HMAC runs entirely in your browser with WebCrypto. Secrets and payloads never leave the tab.

Why timing-safe compare?

Naive string equality can leak prefix matches via timing. This tool compares digests byte-by-byte with a constant-time fold.