diff --git a/Github/Repos/Webhooks/Validate.hs b/Github/Repos/Webhooks/Validate.hs
new file mode 100644
--- /dev/null
+++ b/Github/Repos/Webhooks/Validate.hs
@@ -0,0 +1,26 @@
+-- | Verification of incomming webhook payloads, as described at
+-- <https://developer.github.com/webhooks/securing/>
+
+module Github.Repos.Webhooks.Validate (
+  isValidPayload
+) where
+
+import Crypto.Hash
+import qualified Data.ByteString.Char8 as BS
+
+
+-- | Validates a given payload against a given HMAC hexdigest using a given
+-- secret.
+-- Returns 'True' iff the given hash is non-empty and it's a valid signature of
+-- the payload.
+isValidPayload
+  :: String             -- ^ the secret
+  -> Maybe String       -- ^ the hash provided by the remote party
+                        -- in @X-Hub-Signature@ (if any),
+                        -- including the 'sha1=...' prefix
+  -> BS.ByteString      -- ^ the body
+  -> Bool
+isValidPayload secret shaOpt payload = Just sign == shaOpt
+  where
+    hm = hmac (BS.pack secret) payload :: HMAC SHA1
+    sign = "sha1=" ++ (show . hmacGetDigest $ hm)
diff --git a/github.cabal b/github.cabal
--- a/github.cabal
+++ b/github.cabal
@@ -7,7 +7,7 @@
 -- The package version. See the Haskell package versioning policy
 -- (http://www.haskell.org/haskellwiki/Package_versioning_policy) for
 -- standards guiding when and how versions should be incremented.
-Version:             0.11.0
+Version:             0.11.1
 
 -- A short (one-line) description of the package.
 Synopsis:            Access to the Github API, v3.
@@ -145,6 +145,7 @@
                    Github.Repos.Watching,
                    Github.Repos.Starring,
                    Github.Repos.Webhooks
+                   Github.Repos.Webhooks.Validate,
                    Github.Users,
                    Github.Users.Followers
                    Github.Search
@@ -168,7 +169,8 @@
                  http-types,
                  data-default,
                  vector,
-                 unordered-containers >= 0.2 && < 0.3
+                 unordered-containers >= 0.2 && < 0.3,
+                 cryptohash >= 0.11
 
   -- Modules not exported by this package.
   Other-modules:       Github.Private