Free tool — runs entirely in your browser

Webhook signature verifier

Paste a payload and secret, pick a scheme, and see the computed HMAC-SHA256 signature — or paste a received signature to check it matches. Your secret is never sent anywhere; the Web Crypto API computes everything on this page.

Scheme

Payload (exact raw body — whitespace matters)

Secret

Signature to verify (optional)

Computed signature

—

This is exactly the scheme Mitr's own webhooks use — X-Mitr-Signature: sha256=<hex hmac-sha256(body, secret)>. See more example payloads in the payload explorer, or grade your endpoint with the webhook checker.