HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Verify Received X-Webhook-Signature Header
How do I use HMAC Signature Generator?
Select your HMAC digest algorithm (`HMAC-SHA256`, `HMAC-SHA512`, `HMAC-SHA384`, `HMAC-SHA1`, or `HMAC-MD5`) and output encoding (`Hex` or `Base64`).
Enter your Payload Message and Secret Key, or click 'Sample' to load a realistic webhook signature test.
Copy the computed HMAC signature to verify Stripe, Shopify, GitHub, or JWT webhook headers.
What features does HMAC Signature Generator offer?
Browser-native Web Crypto API calculation (HMAC-SHA256, HMAC-SHA512, HMAC-SHA1)
Hex and Base64 output formats
Live Webhook Signature Verifier with comparison matching status
100% client-side privacy guarantee — secret keys never leave browser
RFC 2104 Keyed-Hash Message Authentication Code (HMAC) Formula
HMAC prevents length-extension attacks on Merkle–Damgård hash functions (like SHA-256) by hashing the secret key with an inner pad (`0x36`) and outer pad (`0x5c`) in two nested passes.
| Provider / Standard | Algorithm | Output Encoding | HTTP Signature Header Format |
|---|---|---|---|
| GitHub Webhooks | HMAC-SHA256 | Hexadecimal (lowercase) | X-Hub-Signature-256: sha256=<hex> |
| Stripe Webhooks | HMAC-SHA256 | Hexadecimal (lowercase) | Stripe-Signature: t=<ts>,v1=<hex> |
| Shopify Webhooks | HMAC-SHA256 | Base64 Standard | X-Shopify-Hmac-Sha256: <base64> |
| JWT HS256 / HS512 | HMAC-SHA256 / 512 | Base64URL (no padding) | Header.Payload.<base64url_sig> |
Frequently Asked Questions about HMAC Signature Generator
Why use `HMAC-SHA256(key, message)` instead of simply hashing `SHA256(key + message)`?
Naive `SHA256(secret + message)` constructions are vulnerable to length-extension attacks, where an attacker who knows `SHA256(secret + message)` and the length of `secret` can append malicious data and compute a valid hash without knowing the secret key. RFC 2104's double-hash `opad`/`ipad` construction eliminates this vulnerability.
Why doesn't my computed HMAC match the signature sent by Stripe or Shopify?
Webhook HMACs must be computed over the exact raw UTF-8 HTTP request body bytes before `JSON.parse()` re-serializes whitespace. Also check whether the provider encodes the digest as lowercase `Hex` (GitHub, Stripe) or `Base64` (Shopify).
Why must backend servers compare HMAC signatures using `crypto.timingSafeEqual`?
Standard string equality (`a === b`) returns `false` on the first mismatched byte, leaking timing side-channel information that lets attackers guess signatures byte-by-byte. Always use constant-time comparison in production.
Is my API secret key ever transmitted to a server when generating an HMAC here?
Never. All HMAC calculations run 100% locally in your browser memory.
Explore Related Developer Tools
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.
Hash Generator
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hash digests from text or files.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.
JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.