Articles · Developer Tools
Sign and verify webhooks without shipping the secret
Webhook handlers fail in two boring ways: the payload you signed is not the bytes you verified, and the secret leaked into a screenshot of a “HMAC playground” website. Computing HMAC in the browser with Web Crypto lets you debug a signature while the key stays in a password field. Hex and Base64 encodings cover the two shapes most docs print. Verify mode compares an expected value without rewriting it into a lucky match.
Why this is worth doing in the browser
DevNestro’s Webhook Signature Playground uses HMAC-SHA-256, SHA-384, and SHA-512 only. The secret and payload are not posted to DevNestro. Hex comparison ignores whitespace and hex case the same way the File Hash checker does; Base64 comparison is exact after trim. Provider-specific header prefixes (Stripe, GitHub, Slack) are not invented. Timing is not a cryptographic audit. Analytics may record that you generated or verified a signature, never the secret or body.
How to use the tool
Paste the raw body, enter the secret, pick algorithm and encoding, generate, or paste an expected signature and verify. Copy the digest. Related File Hash is for file checksums, not HMAC. Related Secret Leak Inspector is for when the secret accidentally landed in a log.
- Sign the exact bytes your server will see, including whitespace.
- Do not screenshot the secret field.
- Use hex-upper only if the vendor prints uppercase.
- A match means the digest matches, not that the webhook is authentic in production.
Privacy
HMAC runs in your browser with Web Crypto. Secrets and payloads are not uploaded and are not sent to analytics.
Debugging a webhook signature? Open the playground, keep the secret on this device, and compare hex locally.