Cómo usar: HMAC Generator
- Paste the message exactly as it is signed — the raw request body for webhooks.
- Enter the secret key and pick its encoding.
- Choose the hash algorithm; the HMAC updates instantly.
- Paste a received signature into Expected signature to verify it.
What is HMAC?
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a hash function to produce a signature. Anyone with the key can compute the same value; anyone without it cannot forge one. APIs use HMAC to sign requests (AWS Signature v4, many payment gateways) and webhooks use it so you can prove a callback really came from the sender.
Verifying webhooks
| Service | Header | Algorithm / encoding |
|---|---|---|
| GitHub | X-Hub-Signature-256 | HMAC-SHA256, hex, prefixed sha256= |
| Stripe | Stripe-Signature | HMAC-SHA256 hex of timestamp.body |
| Shopify | X-Shopify-Hmac-Sha256 | HMAC-SHA256, Base64 |
| Slack | X-Slack-Signature | HMAC-SHA256 hex of v0:timestamp:body |
The most common reason a signature does not match is that the body was changed before signing — parsed and re-serialized JSON, different whitespace or line endings. Always sign the raw bytes you received. The verifier above accepts hex (with or without sha256=), Base64 and Base64url.
HMAC vs plain hashes
A plain SHA-256 hash proves integrity but not authenticity: anyone can recompute it after changing the message. HMAC includes the secret, so only key holders can produce a valid value. Use a key of at least as many random bytes as the hash output (32 for SHA-256). In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.
For unkeyed hashes, use the hash generator; for signed tokens, the JWT encoder.
También se busca como: hmac sha256, hmac online, hmac sha256 online, webhook signature, hmac sha512, verify hmac.
Herramientas que combinan con: HMAC Generator
- Decodificador JWT — Pega un token web JSON para examinar su encabezado y su carga útil, comprobar cuándo caduca y verificar su firma.
- Codificación y descodificación Base64 — Convierte texto a Base64 y viceversa con compatibilidad total con UTF-8 (acentos, emojis), cambia a Base64 compatible con URL o arrastra un archivo para obtener su cadena Base64 o su URI de datos.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
Preguntas frecuentes
Why does my HMAC not match the webhook signature?
sha256=.