HMAC Generator
Generate HMAC using your secret key for message authentication
About the HMAC Signature Verifier
This tool computes an HMAC signature from a payload and secret using SHA-256, SHA-384 or SHA-512, so you can compare it against the signature a provider sent and find out why a webhook is being rejected.
An HMAC signature is what a webhook provider attaches so your endpoint can prove the request is genuine. The provider signs the payload with a shared secret and sends the result in a header; your code recomputes it and compares.
When that comparison fails, the cause is almost always the payload rather than the secret. Signatures are computed over the exact raw bytes received, so anything that re-serialises the body — a JSON parse and re-stringify, a framework that normalises whitespace, a proxy that reformats — produces a different signature from identical-looking data.
Computing the expected value by hand is how you isolate that. If the signature computed here from the raw body matches the header, your code is mangling the payload before verifying; if it does not, the secret or the algorithm is wrong.
How to use the HMAC Signature Verifier
- Paste the raw payload. Use the exact bytes received, not a reformatted version.
- Enter the shared secret. Provide the signing secret from the provider.
- Pick the algorithm. Match the provider — usually SHA-256.
- Compare with the header. Check the computed signature against the one received.
HMAC Signature Verifier features
- HMAC with SHA-256, SHA-384 and SHA-512
- Comparison against a received signature
- Hexadecimal output for header matching
- Aimed at webhook signature debugging
- Secret never leaves your browser
- Runs entirely in your browser
Frequently asked questions
Why is my webhook signature not matching?
Almost always the payload. Signatures cover the exact raw bytes, so any re-serialisation of the body changes the result.
Which algorithm do providers use?
SHA-256 is the most common. Check the provider documentation, since the header format also varies.
Should I compare signatures with ===?
No. Use a constant-time comparison in production, since a character-by-character check leaks timing information.
Does the secret leave my browser?
No. The HMAC is computed locally and nothing is transmitted.
What if the computed value matches but my code still rejects it?
Then your code is transforming the payload before verifying. Sign the raw body as received.