HTMLWebhook Signature Verifier
Paste a webhook body, shared secret, and signature header to verify HMAC-SHA256 signatures or generate a matching header for local tests. Normalizes common sha256=, v1=, and hex header formats, builds a copyable verification checklist, exports a Node verification snippet, and generates a safe verification test pack with env placeholders and payload hash checks. Everything runs in your browser.
Ctrl+Enter to run | Ctrl+K to switch tools | Recent button shows input history
Repeating this work? Turn this kind of browser utility into an API batch, MCP prompt, extension workflow, or shared team recipe.
Buy Pro Browse tool packsFAQ
What signature format does it support?
It verifies HMAC-SHA256 signatures in common formats such as sha256=<hex>, v1=<hex>, and bare hex digests.
Does my webhook secret leave the browser?
No. The verifier uses the browser Web Crypto API locally and does not send the secret, payload, or signature to HTMLToolz.
What is in the verification test pack?
The pack includes .env.example placeholders, reviewed raw-body and signed-payload SHA-256 checks, and a Node verifier that reads webhook-body.txt locally. It intentionally omits the shared secret and raw webhook body.
Can it verify Stripe or Slack signatures completely?
Use this for the HMAC comparison and local test fixtures. Some providers include timestamp or signed-base-string rules that you should confirm against their official docs before production enforcement.
What is the Node snippet for?
It gives developers a reviewed starting point for constant-time HMAC verification in a backend route or CI smoke test.