How to use the HMAC Generator
- Paste the message exactly as it is signed — the raw request body for webhooks.
- Enter the secret key and pick its encoding.
- Choose the hash algorithm; the HMAC updates instantly.
- Paste a received signature into Expected signature to verify it.
What is HMAC?
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a hash function to produce a signature. Anyone with the key can compute the same value; anyone without it cannot forge one. APIs use HMAC to sign requests (AWS Signature v4, many payment gateways) and webhooks use it so you can prove a callback really came from the sender.
Verifying webhooks
| Service | Header | Algorithm / encoding |
|---|---|---|
| GitHub | X-Hub-Signature-256 | HMAC-SHA256, hex, prefixed sha256= |
| Stripe | Stripe-Signature | HMAC-SHA256 hex of timestamp.body |
| Shopify | X-Shopify-Hmac-Sha256 | HMAC-SHA256, Base64 |
| Slack | X-Slack-Signature | HMAC-SHA256 hex of v0:timestamp:body |
The most common reason a signature does not match is that the body was changed before signing — parsed and re-serialised JSON, different whitespace or line endings. Always sign the raw bytes you received. The verifier above accepts hex (with or without sha256=), Base64 and Base64url.
HMAC vs plain hashes
A plain SHA-256 hash proves integrity but not authenticity: anyone can recompute it after changing the message. HMAC includes the secret, so only key holders can produce a valid value. Use a key of at least as many random bytes as the hash output (32 for SHA-256). In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.
For unkeyed hashes, use the hash generator; for signed tokens, the JWT encoder.
Tools that pair well with the HMAC Generator
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- Bcrypt Generator & Checker — Create bcrypt hashes for test users, seed data or config files, and check whether a password matches a stored hash — without sending either anywhere.
- Htpasswd Generator — Generate user:hash lines for HTTP Basic Authentication in Apache, Nginx, Traefik and Caddy — with bcrypt by default and nothing sent to a server.
Frequently asked questions
Why does my HMAC not match the webhook signature?
sha256=.