How to use Webhook HMAC
- 1. Paste the body. Exact bytes matter.
- 2. Pick a provider. Stripe, GitHub, Slack, Razorpay.
- 3. Sign or verify. Compare timing-safe on your side too.
- 4. Never use live secrets here on a shared PC. Rotate if you did.
About this tool
Webhook forgeries are stopped with HMAC. Each provider packs the signature differently. This tool reproduces the packing so your unit tests can assert locally.
Stripe
t=timestamp,v1=hex of HMAC(secret, t + '.' + body).
GitHub
sha256=hex of HMAC(secret, body). Slack uses v0:timestamp:body. Razorpay is hex HMAC of the body.
Code examples
GitHub
X-Hub-Signature-256: sha256=...