HMAC Generator and Verifier
Compute HMAC-SHA1, SHA-256, SHA-384 and SHA-512 of a message in hex and Base64, and check a webhook signature against all of them.
Free · No sign-up · Your inputs stay in your browser
Input
Generate and verify an HMAC signature
Output
Signatures
Compare signatures with a constant-time function on the server: hash_equals() in PHP, crypto.timingSafeEqual() in Node. A plain == leaks how many leading characters were right.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
How webhooks are signed
GitHub, Stripe, Shopify and most other services sign each webhook with an HMAC of the raw request body and a shared secret, and send it in a header. The receiver computes the same HMAC and compares. GitHub's X-Hub-Signature-256 is sha256= plus the hex HMAC-SHA256; Stripe signs the timestamp, a dot and the body.
Why verification fails
Almost always because the bytes differ: the framework parsed and re-encoded the JSON before the HMAC was computed, so whitespace or key order changed. Read the raw body ($request->getContent() in Laravel) and sign that. Then compare with hash_equals(), never ==, so the time taken does not reveal how much of the signature matched.