Webhook HMAC signature checker

Compare a supplied HMAC signature with the exact UTF-8 request body locally.

About this tool

How do I use this tool?

Compare a supplied HMAC signature with the exact UTF-8 request body locally.

What should I check before using the result?

Runs locally with Web Crypto over the exact entered UTF-8 body, including whitespace. Secret is not stored, exported or sent. Supports HMAC SHA-256 and SHA-512 with hexadecimal or standard Base64 signatures. Timestamp prefixes, canonicalized fields, RSA, Ed25519 and replay validation are not implemented; follow the provider signing specification.

Worked example

Use the exact test vector below. Changing even one space produces a different signature.

HMAC_SHA256(key="key", body="The quick brown fox jumps over the lazy dog") = f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Related tools

Method references

Documentation updated 2026-10-20