How do I verify an HMAC signature, for example from a webhook?

Compute the HMAC of the exact body you received with the shared secret and the provider’s hash, then paste the signature they sent into Expected signature. It is read as hex, Base64 or Base64URL and the tool says Match or No match. With a provider preset, a prefix such as sha256= may stay on the pasted value; without one, remove it first or the signature is not read.

Can the HMAC key be empty?

Yes. RFC 2104 pads the key with zero bytes to the block size, so an empty key is valid. HMAC-SHA256 with an empty key and an empty message is b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad.

What happens to a key longer than the block size?

It is hashed first and the hash is used as the key, as RFC 2104 says. The tool uses a 64-byte block for SHA-1 and SHA-256 and a 128-byte block for SHA-384 and SHA-512.

How long should an HMAC key be?

RFC 2104 recommends at least the length of the hash output, 32 bytes for SHA-256, and strongly discourages shorter keys. A key much longer than that adds little strength.

No. An HMAC shows that whoever made it had the same secret key and that the message was not changed; the message itself stays readable.

Is my secret key uploaded?

The HMAC is computed by code in this page with the browser’s Web Crypto hash; the key and message are not uploaded or saved by the tool. Web Crypto works only on https pages and on localhost.

HMAC Generator

Compute an HMAC with SHA-1, SHA-256, SHA-384 or SHA-512 and check it against a signature, with webhook presets for GitHub, Stripe, Shopify and Slack. How it works

Provider preset

Pick a webhook provider to set the key format, algorithm, output format and signed text; every setting stays editable.

Message

Read as UTF-8 text; may be empty. Up to 1,000,000 characters.

Secret Key

May be empty. Up to 100,000 characters.

Key is written as

Algorithm

Output format

Result

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Expected signature (optional, to compare)

Paste a signature as hex, Base64 or Base64URL to compare it with the result.

HMAC-SHA-1 is not weakened by SHA-1 collisions, but new designs should use SHA-256 or stronger.

About the HMAC Generator

HMAC-SHA256 of the message “The quick brown fox jumps over the lazy dog” with the key “key” is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. This HMAC generator computes HMAC with SHA-1, SHA-256, SHA-384 or SHA-512 as RFC 2104 defines it, prints hex, Base64 or Base64URL, and compares the result with a signature you paste. Presets for GitHub, Stripe, Shopify, Slack and Standard Webhooks build the exact text each provider signs.

The same key and message with each hash

Algorithm	Block size	HMAC length	HMAC in hex
SHA-1	64 bytes	20 bytes	de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9
SHA-256	64 bytes	32 bytes	f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
SHA-384	128 bytes	48 bytes	d7f4727e2c0b39ae0f1e40cc96f60242d5b7801841cea6fc592c5d3e1ae50700582a96cf35e1e554995fe4e03381c237
SHA-512	128 bytes	64 bytes	b42af09057bac1e2d41708e48a902e09b5ff7f12ab428a4fe86653c73dd248fb82f948a549f7b791a5b41915ee4d1ec3935357e4e2317250d0372afa2ebeeb3a

Key “key” and message “The quick brown fox jumps over the lazy dog”, both as UTF-8 text.

HMAC-SHA256 of the same input in each output format

Output format	Value
Hex	f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Base64	97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=
Base64URL	97yD9DBThCSxMpjmqm-xQ-9NWaFJRhdZl0edvC0aPNg

Webhook provider presets

Provider	Signed text	Key	Signature	Header
GitHub	request body	webhook secret as text	hex with sha256= prefix	X-Hub-Signature-256
Stripe	timestamp + "." + body	whsec_ signing secret as text	hex	Stripe-Signature (the v1= value)
Shopify	request body	app client secret as text	Base64	X-Shopify-Hmac-SHA256
Slack	"v0:" + timestamp + ":" + body	signing secret as text	hex with v0= prefix	X-Slack-Signature
Standard Webhooks	id + "." + timestamp + "." + body	Base64 part of the whsec_ secret	Base64 with v1, prefix	webhook-signature

All five use HMAC-SHA256, from each provider’s verification page. The timestamp is in Unix seconds, copied from the request header. Stripe and Slack advise rejecting a request whose timestamp is more than 5 minutes old; this page does not check the age.

How to use this tool

To check a GitHub webhook, choose GitHub under Provider preset, put the webhook secret in Secret Key and paste the request body exactly as it arrived into Message.
Paste the X-Hub-Signature-256 header value into Expected signature; with the preset, the sha256= prefix may stay.
Read Match or No match. No match with the right secret usually means the body was changed on the way, for example re-formatted JSON.

Frequently asked questions

How do I verify an HMAC signature, for example from a webhook?: Compute the HMAC of the exact body you received with the shared secret and the provider’s hash, then paste the signature they sent into Expected signature. It is read as hex, Base64 or Base64URL and the tool says Match or No match. With a provider preset, a prefix such as sha256= may stay on the pasted value; without one, remove it first or the signature is not read.
Can the HMAC key be empty?: Yes. RFC 2104 pads the key with zero bytes to the block size, so an empty key is valid. HMAC-SHA256 with an empty key and an empty message is b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad.
What happens to a key longer than the block size?: It is hashed first and the hash is used as the key, as RFC 2104 says. The tool uses a 64-byte block for SHA-1 and SHA-256 and a 128-byte block for SHA-384 and SHA-512.
How long should an HMAC key be?: RFC 2104 recommends at least the length of the hash output, 32 bytes for SHA-256, and strongly discourages shorter keys. A key much longer than that adds little strength.
Is HMAC encryption?: No. An HMAC shows that whoever made it had the same secret key and that the message was not changed; the message itself stays readable.
Is my secret key uploaded?: The HMAC is computed by code in this page with the browser’s Web Crypto hash; the key and message are not uploaded or saved by the tool. Web Crypto works only on https pages and on localhost.

Important limitations

The key can be up to 100,000 characters, typed as UTF-8 text, hex bytes or Base64 bytes. The message can be up to 1,000,000 characters and is always read as UTF-8 text, so raw binary data cannot be signed here. HMAC-MD5 is not offered. A provider without a preset that signs more than the body, such as a timestamp joined to it, needs that exact joined string pasted as the message; check its documentation. A header holding several signatures, such as Stripe’s t=…,v1=… or a space-separated Standard Webhooks list, has to be cut down to one signature before pasting.

Sources

Last reviewed: 2026-10-22

Checking a webhook signature

Check a webhook signature against the body you received, build the signature for a request you are about to send, or find out why your own code gives a different HMAC from a provider's documented example. Paste the provider's signature into the compare box to get Match or No match.

The Provider preset list sets the key format, algorithm, output format and signed text for GitHub, Stripe, Shopify, Slack and Standard Webhooks; every setting stays editable. Stripe and Slack sign a Unix timestamp in seconds joined to the body, and Standard Webhooks also signs the webhook id, so those presets add the fields for them. With a preset, the signature carries the provider's prefix (sha256=, v0= or v1,) and a pasted header value is accepted with or without it.

Example with the Slack preset: secret key, timestamp 1531420618 and body Hello sign the text v0:1531420618:Hello and give v0=60f80c01456ddb3ce4c279a88382b32f3db68e6e1932455eeb34de6855e38797. The secret key is not saved and is never put in a link.

How the HMAC is computed

RFC 2104 defines:

HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m))

H is SHA-1, SHA-256, SHA-384 or SHA-512.
K′ is the key padded with zero bytes to the hash's block size, 64 bytes for SHA-1 and SHA-256 and 128 bytes for SHA-384 and SHA-512. A key longer than a block is hashed first.
ipad is the byte 0x36 repeated and opad the byte 0x5C repeated; ⊕ is XOR and ‖ joins the bytes.

Example: key key, message The quick brown fox jumps over the lazy dog, SHA-256 gives f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 in hex and 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg= in Base64.

The key can be typed as UTF-8 text, hex bytes or Base64 bytes; the message is read as UTF-8 text. Limits: key 100,000 characters, message 1,000,000.

Related Tools

View all tools

Dev

Password Generator

Generate a random password of 8 to 128 characters from uppercase, lowercase, numbers and symbols, and see its entropy in bits. Can skip look-alike characters.

Dev

Hash Generator

Compute the MD5, SHA-1, SHA-256, SHA-384 or SHA-512 hash of text or a file and compare it with an expected checksum. The file is hashed in your browser.

Dev

AES Encryption

Encrypt and decrypt text with a password using AES-256-GCM, the key derived by PBKDF2-SHA256 at 600,000 iterations. Strength depends on the password.

Dev

PBKDF2 Calculator

Derive a PBKDF2 key in hex or Base64 from a password and salt with HMAC-SHA-1, SHA-256, SHA-384 or SHA-512, and check it against a key you paste.

Dev

Unicode Lookup

Look up any character or code point such as U+1F600: its name, category, script, block and UTF-8, UTF-16 and UTF-32 bytes, or search names and browse blocks.

Dev

AWS Data Transfer Cost Estimator

AWS data transfer out (egress) cost per month from GB to the internet, other Regions and the same Region, with the 100 GB free tier and volume tiers.