SOSECIO
Local processing active
Use tool

HMAC and webhook signature debugger

Generate and compare HMAC signatures locally with browser Web Crypto for webhook/API signature debugging. Secret and payload values are not uploaded, stored, written to the URL, or sent to backend logs.

Use devices you control and test or redacted material. Production signing secrets belong on your server. This page performs a local byte-signature comparison only.

Hex
Base64
Header ready output
Redacted debug report

Raw body

Stripe, Slack, Paddle, Razorpay, and similar flows usually require the raw body captured before JSON/body parser reserialization. Whitespace and newline changes alter the signature.

Timestamp and replay

Timestamp hints use this browser clock only. They do not prove server clock correctness, replay-window acceptance, or provider state.

Local comparison

A match means this browser reproduced the same digest from the selected bytes, secret, algorithm, and recipe. It is not provider-origin proof, replay protection, or server-side acceptance.

Redacted report

The report omits raw secret, raw payload, signature header text, complete signatures, and complete message id while keeping useful debugging facts.

Server-side verification

Production verification should keep secrets server-side, use official libraries or constant-time comparison, and handle idempotency, time windows, and logging separately.

Recommended from common tool workflows. This section does not read or pass page input.

Webhook signature recipe lookupLook up webhook signature headers, raw-body rules, timestamp and replay checks, payload joining, and server-side validation recipes without secret input.Hash calculatorCalculate SHA-1, SHA-256, SHA-384, and SHA-512 digests with Web Crypto for UTF-8, Hex, Base64, and Base64URL byte input.Base64 encoder and decoderEncode and decode Standard Base64 and Base64URL locally in the browser, with strict validation and lenient padding repair.JWT decoderDecode JWT header and payload locally, with optional pasted RSA JWK or JWKS public-key checks for RS256, RS384, and RS512.