RetryxSignature Generator
Generate an HMAC-SHA256 webhook signature for any payload and secret, or paste a signature to check whether it is valid. It all runs in your browser.
How webhook signatures work
A webhook signature proves that a request came from the sender and was not changed on the way. The sender computes an HMAC-SHA256 of the request body with a shared secret and sends the result in a header. The receiver repeats the calculation on the raw body and compares the two values in constant time.
The timestamped format signs timestamp.body and sends t=…,v1=…, which lets the receiver also reject old requests and block replays. This is the scheme used by Retryx deliveries and by several large providers. See Verify signatures for production code in four languages.
How to use it
- Choose a format: timestamped (t=…,v1=…) or a plain HMAC of the body.
- Enter your secret and paste the exact raw payload.
- Generate mode shows the header and a ready-to-run cURL command. Verify mode checks a signature you paste.
- Always verify against the raw bytes received, not a re-serialised copy.
Frequently asked questions
- Is my secret sent anywhere?
- No. Signing uses your browser’s built-in Web Crypto API. Nothing is uploaded, logged or stored.
- Why does verification fail even though the secret is right?
- Almost always the body was changed before hashing: parsed and re-stringified JSON, trimmed whitespace, or a different character encoding. Hash the raw bytes exactly as received.
- What is the timestamp for?
- It is included in the signed text, so an attacker cannot replay an old valid request later. Receivers should reject timestamps more than about 5 minutes away from now.
- Is this the same as Stripe’s or GitHub’s format?
- The timestamped format signs “timestamp.body” with HMAC-SHA256 like Stripe-style signatures; header names differ. The plain mode matches schemes that sign only the body, hex-encoded.
- Should I compare signatures with ==?
- No. Use a constant-time comparison in your server code to avoid timing attacks. The docs have examples.