Skip to content
littlekit.app
All tools

Webhook signature verifier

Verify a pasted HMAC webhook signature with local Web Crypto and omit the secret from every result.

The exact UTF-8 payload bytes to verify.
Used only for this local Web Crypto check. It is never included in the result or export.
A sha256=/sha384=/sha512= prefix is accepted; choose its remaining encoding below.
Verification flow
  1. Encode your exact payload as UTF-8.
  2. Compute HMAC locally with Web Crypto.
  3. Compare only the received and computed bytes.

The report records the match result and never includes the secret or generated signature.

Processed on your device

How it works & useful details

Local-only workspace

This tool converts or inspects pasted text in your browser. It never sends a request, opens a URL, uploads a HAR, or stores your input.

HMAC signature check

The browser imports a non-extractable key for the duration of the check and compares HMAC bytes locally. The report omits the secret and computed signature. Match results only show that the supplied bytes agree; they do not establish sender identity on their own.