Como usar: HMAC Generator
- Paste the message exactly as it is signed — the raw request body for webhooks.
- Enter the secret key and pick its encoding.
- Choose the hash algorithm; the HMAC updates instantly.
- Paste a received signature into Expected signature to verify it.
What is HMAC?
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with a hash function to produce a signature. Anyone with the key can compute the same value; anyone without it cannot forge one. APIs use HMAC to sign requests (AWS Signature v4, many payment gateways) and webhooks use it so you can prove a callback really came from the sender.
Verifying webhooks
| Service | Header | Algorithm / encoding |
|---|---|---|
| GitHub | X-Hub-Signature-256 | HMAC-SHA256, hex, prefixed sha256= |
| Stripe | Stripe-Signature | HMAC-SHA256 hex of timestamp.body |
| Shopify | X-Shopify-Hmac-Sha256 | HMAC-SHA256, Base64 |
| Slack | X-Slack-Signature | HMAC-SHA256 hex of v0:timestamp:body |
The most common reason a signature does not match is that the body was changed before signing — parsed and re-serialized JSON, different whitespace or line endings. Always sign the raw bytes you received. The verifier above accepts hex (with or without sha256=), Base64 and Base64url.
HMAC vs plain hashes
A plain SHA-256 hash proves integrity but not authenticity: anyone can recompute it after changing the message. HMAC includes the secret, so only key holders can produce a valid value. Use a key of at least as many random bytes as the hash output (32 for SHA-256). In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.
For unkeyed hashes, use the hash generator; for signed tokens, the JWT encoder.
Também pesquisado como: hmac sha256, hmac online, hmac sha256 online, webhook signature, hmac sha512, verify hmac.
Ferramentas que combinam com: HMAC Generator
- Decodificador JWT — Cole um JSON Web Token para analisar seu cabeçalho e sua carga, verificar quando ele expira e conferir sua assinatura.
- Codificação/Decodificação Base64 — Converte texto para Base64 e vice-versa, com suporte total a UTF-8 (acentos, emojis); alterna para Base64 seguro para URLs; ou arrasta um arquivo para obter sua string Base64 ou URI de dados.
- AES Encrypt & Decrypt — Protect a note, secret or config value with a password using AES-256 — or decrypt text produced by openssl enc.
- IBAN Validator — Check whether an IBAN is valid before you send money or save it: the country, the length for that country, the account format and the mod-97 checksum.
Perguntas frequentes
Why does my HMAC not match the webhook signature?
sha256=.