Signature Verification
Verify payment and API signatures. Compare computed HMAC/RSA signatures with received values. Supports MD5, SHA1, SHA256, SHA512, RSA-SHA256.
Common Payment Signature Rules
Alipay: Sort params by key, concatenate with &, append key, then sign with MD5 or RSA2 (SHA256).
WeChat Pay: Sort params by ASCII, concatenate with &key=, then sign with HMAC-SHA256 or MD5.
Stripe: Use HMAC-SHA256 with the signing secret. Compare using timing-safe equals.
Tip: Paste the raw parameter string (before signing) as the message. The signature should be computed on exactly this string.
How to use this tool
Compare a computed payment or API signature with a received value during an authorized integration test.
Suggested workflow
- Recreate the exact signed payload and algorithm.
- Use a test key from your sandbox environment.
- Compare the calculated signature with the received signature.
Good to know
Only test services and credentials you own or are explicitly authorized to use.
Signature Verification - CodeTools Toolbox - 47 free online developer tools.