HMAC generator and signature checker
Sign a message with a shared secret, or check that a webhook really came from the service that holds the secret. Paste the signature header as it arrived; the sha256= prefix is understood.
Se ejecuta por completo en tu navegador: no se envía nada a ningún sitio
How webhook signatures work
The sender computes HMAC(secret, body) and sends it in a header. The receiver computes the same over the body it received and compares. Only someone holding the secret can produce a matching signature, so a match proves the message is authentic and unaltered.
Why does my signature not match?
Almost always because the message differs by a byte: a framework parsed and re-serialised the JSON, or line endings changed. Sign the raw body exactly as received.
Is the secret sent anywhere?
No. The HMAC is computed in your browser. Still, treat real webhook secrets as passwords.