HMAC Generator
Generate and verify HMAC signatures for text payloads.
The output will appear here.Paste the signature header a webhook sent you to check it against the one generated here.
How it works
An HMAC is a keyed hash. It combines a message with a secret key so that anyone holding the key can confirm both that the message is intact and that it came from someone who knows the key, which a plain hash cannot do.
This is the mechanism behind webhook signatures from Stripe, GitHub, Shopify, and most other providers: they send a header containing the HMAC of the request body, and your endpoint recomputes it with the shared secret to decide whether to trust the request.
Signatures are computed with the browser's Web Crypto API over SHA-1, SHA-256, SHA-384, or SHA-512, and shown as lowercase hex or as Base64, since providers differ on which they send. Paste the signature you received into the verify field and the tool reports whether it matches. Both the payload and the secret are treated as UTF-8 text, and the page has to be served over HTTPS because Web Crypto requires a secure context.
Frequently asked questions
- What is the difference between a hash and an HMAC?
- A hash needs no key, so anyone can recompute it after altering the message. An HMAC mixes in a secret key, so only holders of that key can produce or check the value, which is what makes it an authentication code.
- How do I verify a webhook signature?
- Compute the HMAC of the exact raw request body with your shared secret and the algorithm the provider documents, then compare it to the signature header using a constant-time comparison in your own code. To check a single request by hand, paste the body and secret here and the header value into the verify field: a leading sha256= is ignored, and hex is matched without regard to case.
- Why does my signature not match the provider's?
- Almost always the payload differs by a byte: a re-serialised JSON body, a trailing newline, or the wrong encoding. Some providers also sign a constructed string such as a timestamp plus the body, not the body alone.
- Is it safe to paste a real signing secret here?
- The signature is computed inside your browser and the page makes no network requests, so the secret is not transmitted. For a production secret, prefer a local script and rotate anything you have pasted into a tool you do not control.
- Which algorithm should I choose?
- SHA-256 unless the provider says otherwise, as it is the default for nearly every webhook API. HMAC-SHA1 remains acceptable for authentication and is still used by older APIs such as AWS Signature Version 2.