Webhook HMAC signature verify
Check a webhook payload against its HMAC signature, on your device, including Stripe and GitHub header formats.
Webhook HMAC signature verify recomputes an HMAC over your pasted payload and checks it against signature with a constant-time comparison, closing a timing side-channel. Stripe format always signs timestamp.payload under SHA-256; GitHub format reads its own sha256= or sha1= prefix to pick the algorithm. A malformed Stripe or GitHub header is refused before any HMAC runs.
Questions
What signature formats are supported?
Plain hex, plain base64, and the specific Stripe-Signature and GitHub X-Hub-Signature-256 header formats.
How does Stripe format differ?
It always uses SHA-256 regardless of the algo dropdown, and signs timestamp.payload rather than the payload alone.
How does GitHub format work?
It reads its own sha256= or sha1= prefix from the signature field to choose the algorithm automatically.
Why constant-time comparison?
So the check does not leak timing information about how many leading bytes of the signature matched, which a naive comparison can expose.
What happens with a malformed Stripe or GitHub header?
The tool refuses, naming the exact fields it expected in that format.