OneFreePlace
TOOL #373 · CONSTANT-TIME HMAC VERIFICATION LAB

HMAC Verifier

Verify HMAC tags without sending secrets anywhere. Decode common signature formats, use the browser's cryptographic verify primitive, inspect exact message/key bytes, parse webhook-style signature headers, check timestamp freshness, and batch-check known message/signature pairs with one shared secret.

Web Crypto verify()Auto Hex / Base64 / Base64URLsha256= prefix supportWebhook header inspectorReplay-window helperBatch verificationExact byte diagnostics100% local

Message

Shared secret

Received signature

auto detect
Algorithm—
Message bytes—
Key bytes—
Expected bytes—
Length match—
Key fingerprint—

Webhook signature header inspector

Paste a comma-separated header such as t=1710000000,v1=.... This lab does not assume any vendor's protocol; you choose which component is the signature and how the signed string is assembled.

Timestamped payload verifier

Freshness is advisory only; provider-specific replay rules can differ.

Batch verifier

signature ⇥ message

One pair per line, separated by a TAB. Uses the selected algorithm, secret and signature encoding from the main verifier. Maximum 1,000 rows.

Total0
Valid0
Invalid0
Errors0

Do not compare strings naively

Verification here delegates the cryptographic tag comparison to Web Crypto's HMAC verify operation after strict decoding and length checks.

Keep the raw request body

Webhook systems frequently sign the exact received bytes. Re-serializing JSON can change whitespace or key ordering and invalidate the signature.

Replay protection is separate

A valid HMAC can still be replayed. If your protocol includes a timestamp, enforce the provider's allowed age and idempotency rules.

Secret hygiene

Use unique secrets per integration, rotate them safely, and never paste production secrets into third-party web tools. This tool runs locally in your browser.