HMAC generator and signature checker
Sign a message with a shared secret, or check that a webhook really came from the service that holds the secret. Paste the signature header as it arrived; the sha256= prefix is understood.
完全在你的浏览器中运行 — 不会发送到任何地方
完全在你的浏览器中运行 — 不会发送到任何地方
How webhook signatures work
The sender computes HMAC(secret, body) and sends it in a header. The receiver computes the same over the body it received and compares. Only someone holding the secret can produce a matching signature, so a match proves the message is authentic and unaltered.
Why does my signature not match?
Almost always because the message differs by a byte: a framework parsed and re-serialised the JSON, or line endings changed. Sign the raw body exactly as received.
Is the secret sent anywhere?
No. The HMAC is computed in your browser. Still, treat real webhook secrets as passwords.