Webhook signature generator and verifier
Generate or verify HMAC SHA-256 webhook signatures in your browser. Secrets never leave the device.
Secrets and payloads stay in this browser. Nothing is sent to Fajita servers. Do not paste a production signing secret into a device you do not trust.
Input privacy
Secret, payload, timestamp, and signature stay in browser memory only. No server request. No localStorage. Clear the form when finished. Do not paste a production secret on a device you do not trust.
Methodology
Signed message is timestamp + '.' + raw body. Signature is hex-encoded HMAC SHA-256 of that message using your secret. Verification compares hex digests in constant time after normalizing an optional sha256= prefix.
Use this tool to learn the signed-message shape and to verify fixtures. Prefer generating secrets on trusted machines only.
Security notes
- Compare signatures with a constant-time function in production code
- Reject stale timestamps
- Verify against the raw body, not a re-serialized JSON object
Limitations
- Does not send webhooks
- Does not match every vendor's canonicalization quirks
- Requires Web Crypto in the browser
Did this tool give you what you needed?