# Webhook signature generator and verifier

Generate or verify HMAC SHA-256 webhook signatures in your browser. Secrets never leave the device.

Privacy: Secret, payload, timestamp, and signature stay in browser memory only. No server request. No localStorage. Clear the form when finished. Do not paste a production secret on a device you do not trust.
Methodology: Signed message is timestamp + '.' + raw body. Signature is hex-encoded HMAC SHA-256 of that message using your secret. Verification compares hex digests in constant time after normalizing an optional sha256= prefix.
Network access: no
Stores input: no
Client-side only: yes
Canonical: https://fajita.io/tools/webhook-signature-generator

Use this tool to learn the signed-message shape and to verify fixtures. Prefer generating secrets on trusted machines only.

## Security notes

- Compare signatures with a constant-time function in production code
- Reject stale timestamps
- Verify against the raw body, not a re-serialized JSON object

Limitations:
- Does not send webhooks
- Does not match every vendor's canonicalization quirks
- Requires Web Crypto in the browser