API Signature Tester

Check HMAC Signatures — computed locally in your browser.

Rebuild and compare a signature

Method Path

Timestamp

Body

Secret

Signature to compare (hex or Base64)

Canonical string

Expected HMAC-SHA256 (hex):

Base64:

Verdict: —

Both sides must sign the same canonical string, character for character.

Enter the method, path, timestamp and body exactly as the sender did.
Paste the secret and the signature you received.
Press verify and compare the canonical string, the expected HMAC and the verdict.

Common questions about the free online api signature tester.

Rebuild the canonical string from the method, path, timestamp and body, sign it with the shared secret and compare it with the received signature.

It is the exact byte sequence both sides agree to sign, for example the method, path, timestamp and body joined by newlines in a fixed order.

The usual causes are a different field order, a body that was reformatted, a timestamp in a different unit or the wrong secret.

Yes. Both sides must join the fields in exactly the same order with the same separators, otherwise the digests will differ.

Yes. Including it inside the signature lets the server reject replays by refusing timestamps that are too old.

No. Only the resulting signature is sent, and the secret must stay on the client and the server.

Hex and Base64 are both common. This tool computes both so you can compare against whatever your provider documents.

It can, but the secret is typed into the page, so use a test secret and never paste a production key into any web page.

It uses HMAC with SHA-256, which is the most common choice for API request signing.

Last updated: October 10, 2026