Comment utiliser : HMAC Generator
- Paste the message exactly as it is signed — the raw request body for webhooks.
- Enter the secret key and pick its encoding.
- Choose the hash algorithm; the HMAC updates instantly.
- Paste a received signature into Expected signature to verify it.
What is HMAC?
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a hash function to produce a signature. Anyone with the key can compute the same value; anyone without it cannot forge one. APIs use HMAC to sign requests (AWS Signature v4, many payment gateways) and webhooks use it so you can prove a callback really came from the sender.
Verifying webhooks
| Service | Header | Algorithm / encoding |
|---|---|---|
| GitHub | X-Hub-Signature-256 | HMAC-SHA256, hex, prefixed sha256= |
| Stripe | Stripe-Signature | HMAC-SHA256 hex of timestamp.body |
| Shopify | X-Shopify-Hmac-Sha256 | HMAC-SHA256, Base64 |
| Slack | X-Slack-Signature | HMAC-SHA256 hex of v0:timestamp:body |
The most common reason a signature does not match is that the body was changed before signing — parsed and re-serialized JSON, different whitespace or line endings. Always sign the raw bytes you received. The verifier above accepts hex (with or without sha256=), Base64 and Base64url.
HMAC vs plain hashes
A plain SHA-256 hash proves integrity but not authenticity: anyone can recompute it after changing the message. HMAC includes the secret, so only key holders can produce a valid value. Use a key of at least as many random bytes as the hash output (32 for SHA-256). In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.
For unkeyed hashes, use the hash generator; for signed tokens, the JWT encoder.
Aussi recherché comme : hmac sha256, hmac online, hmac sha256 online, webhook signature, hmac sha512, verify hmac.
Outils complémentaires : HMAC Generator
- Décodeur JWT — Collez un JSON Web Token pour examiner son en-tête et sa charge utile, vérifier sa date d'expiration et valider sa signature.
- Encodage / Décodage Base64 — Convertissez du texte au format Base64 et inversement, avec une prise en charge complète de l'UTF-8 (accents, emojis) ; passez au format Base64 compatible URL, ou glissez-déposez un fichier pour obtenir sa chaîne Base64 ou son URI de données.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
Questions fréquentes
Why does my HMAC not match the webhook signature?
sha256=.