Client-Side Cryptography with the Web Crypto API
Testing webhook signatures and checksums should never require sending API keys to external servers. By utilizing the browser's hardware-accelerated crypto.subtle engine, hashes are calculated in microseconds locally.
Frequently Asked Questions
What is the difference between standard Hashing and HMAC Signatures?
A standard cryptographic hash (like SHA-256 or MD5) computes a one-way fixed-length checksum from input data. An HMAC (Hash-based Message Authentication Code) incorporates a secret cryptographic key, ensuring that the payload has not been tampered with and originated from an authentic sender.
How do I verify webhook signatures for Stripe, GitHub, or Shopify?
Switch to 'HMAC Webhook Signatures' mode, paste the raw JSON webhook payload into the input box, enter your webhook signing secret (e.g., 'whsec_...'), and copy the generated HMAC-SHA256 digest to verify against the 'Stripe-Signature' or 'X-Hub-Signature-256' header.
Is it safe to paste private API secrets and webhook keys into this tool?
Yes, 100% private. All hashing and HMAC operations are executed locally in your browser using the native W3C Web Cryptography API ('crypto.subtle'). No keys or payloads ever leave your device.
Is MD5 secure for password hashing?
No. MD5 is vulnerable to collision attacks and is computationally too fast for passwords. MD5 should only be used for fast non-security checksums and file deduplication. For passwords, use Bcrypt, Argon2, or PBKDF2.
What output formats are generated for SHA-256 hashes?
The tool generates standard lowercase hexadecimal strings (64 hex characters for SHA-256, 128 hex characters for SHA-512) compatible with Linux sha256sum and Node.js crypto.
How do I compute an HMAC-SHA256 signature in Node.js?
In Node.js: 'const crypto = require("crypto"); const signature = crypto.createHmac("sha256", secretKey).update(payload).digest("hex");'.