Verify a webhook HMAC signature locally

The job

A webhook or API spec says "sign the request body with HMAC-SHA256 and send it in this header". While debugging you want to recompute that signature yourself — without standing up a server or pasting your secret into a random site.

How to do it

Paste the payload exactly as the sender produced it — WebCrypto signs the bytes as written, including whitespace — enter the shared secret, pick the algorithm, and read the hex or Base64 signature. Paste the expected signature into the compare field to get a match/mismatch answer without eyeballing.

• SHA-256 is the common default; SHA-1, SHA-384, and SHA-512 are also available.
• Hex output is compared case-insensitively; Base64 padding is optional.

Worked example

Message `The quick brown fox jumps over the lazy dog` with key `key` under HMAC-SHA-256 produces `f7bc83f4…eb31e7b9` — the same value `crypto` and standard libraries return, so a mismatch points to a different payload or key, not the tool.

Limits

Inputs are UTF-8 text up to 500,000 characters each. It signs what you paste: if the real system signs a canonicalized form (sorted fields, trimmed headers), reproduce that form first. Do not paste live production secrets into anything you do not fully trust — the computation is local, but good key hygiene still applies.