HMAC Verifier
Check a signature you were sent. Paste the message, the shared secret and the expected tag, and find out whether they agree.
This page opens in verify mode, which is the one you want when a webhook is being rejected and you need to know whether the signature or the payload is at fault.
Hex case does not matter
Hex digests carry no meaning in their case, so an uppercase signature and its lowercase twin both verify here. Rejecting on case would produce failures that look like tampering and are not.
Base64 is treated differently: whitespace is stripped but case is preserved, because Base64 encodes distinct values in upper and lower case and folding it would produce false matches.
Reading a failure
A mismatch narrows the problem to one of three things: the message bytes differ from what was signed, the secret is wrong, or the algorithm does not match. Checking against a known-good pair first tells you whether your secret is right before you start suspecting the payload.
The most frequent real cause is the body being reparsed and re-serialised somewhere in the middle - a proxy, a framework body parser, a logging layer - so the bytes you verify are not the bytes that were signed.
In production, compare in constant time
Verifying here is for debugging. In your own code, never compare signatures with == or strcmp: those return early on the first differing byte, and the timing difference leaks how much of a forged signature was correct. Use crypto.timingSafeEqual, hmac.compare_digest or subtle.ConstantTimeCompare.