So nutzt du: HMAC Generator
- Paste the message exactly as it is signed — the raw request body for webhooks.
- Enter the secret key and pick its encoding.
- Choose the hash algorithm; the HMAC updates instantly.
- Paste a received signature into Expected signature to verify it.
What is HMAC?
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a hash function to produce a signature. Anyone with the key can compute the same value; anyone without it cannot forge one. APIs use HMAC to sign requests (AWS Signature v4, many payment gateways) and webhooks use it so you can prove a callback really came from the sender.
Verifying webhooks
| Service | Header | Algorithm / encoding |
|---|---|---|
| GitHub | X-Hub-Signature-256 | HMAC-SHA256, hex, prefixed sha256= |
| Stripe | Stripe-Signature | HMAC-SHA256 hex of timestamp.body |
| Shopify | X-Shopify-Hmac-Sha256 | HMAC-SHA256, Base64 |
| Slack | X-Slack-Signature | HMAC-SHA256 hex of v0:timestamp:body |
The most common reason a signature does not match is that the body was changed before signing — parsed and re-serialized JSON, different whitespace or line endings. Always sign the raw bytes you received. The verifier above accepts hex (with or without sha256=), Base64 and Base64url.
HMAC vs plain hashes
A plain SHA-256 hash proves integrity but not authenticity: anyone can recompute it after changing the message. HMAC includes the secret, so only key holders can produce a valid value. Use a key of at least as many random bytes as the hash output (32 for SHA-256). In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.
For unkeyed hashes, use the hash generator; for signed tokens, the JWT encoder.
Auch gesucht als: hmac sha256, hmac online, hmac sha256 online, webhook signature, hmac sha512, verify hmac.
Passende Tools zu: HMAC Generator
- JWT-Decoder — Füge ein JSON-Web-Token ein, um dessen Header und Payload zu überprüfen, das Ablaufdatum zu ermitteln und die Signatur zu verifizieren.
- Base64-Kodierung / -Dekodierung — Konvertiere Text in Base64 und zurück – mit vollständiger UTF-8-Unterstützung (Akzente, Emojis), wechsle zu URL-sicheren Base64-Werten oder zieh eine Datei per Drag & Drop hinein, um deren Base64-Zeichenkette oder Daten-URI zu erhalten.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
Häufige Fragen
Why does my HMAC not match the webhook signature?
sha256=.