Tool
Postback signature verifier
Paste a postback and its secret and see whether the signature checks out, for AdsLab, FaucetPay v2, CoinPayments, NOWPayments and Coinbase Commerce.
A signature mismatch gives you no clue which side is wrong. Computing the expected value by hand — with your secret, the exact bytes, and the scheme the network actually uses — usually finds it in a minute.
Most mismatches are not the algorithm. They are the inputs: a body rebuilt from the parsed array instead of the raw bytes, or a key that looks right and is the wrong one of the two in the dashboard.
Nothing is sent anywhere or stored. The arithmetic runs on this server and the page forgets it.
Notes
AdsLab's signature is not an HMAC at all — it is a plain sha256 over the transaction id, a hyphen and your Security Hash. Their integration page says it is signed with the Publisher API key. It is not, and that one line is responsible for most AdsLab integration time.
For every HMAC scheme here, sign the raw body from php://input. http_build_query($_POST) re-encodes values and will never match.
Compare with hash_equals, never with ==. String comparison short-circuits on the first differing byte and leaks how much of a guess was right.
Do not paste a live secret into any tool on the internet, including this one, if you can test with a staging key instead.