Check that a webhook body matches the signature header its sender attached
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.A webhook arrived and your handler rejects it as tampered. Paste the raw request body exactly as received, the signing secret from the provider dashboard and the signature header, and see whether they match. Headers such as sha256=... from GitHub or t=...,v1=... from Stripe are understood, and the comparison takes the same time whether the first byte or the last one differs.
The page opens on SHA-256 with Verify a signature already switched on.
Paste the signing secret from the provider dashboard into Secret key.
Paste what the sender signed into Message: the raw body for GitHub, or the timestamp, a dot and the raw body for Stripe.
Paste the signature header, such as sha256=... or t=...,v1=..., into the Expected signature box.
Read the verdict: Signatures match, or Signatures do not match.
This HMAC generator computes a keyed hash of text or a file with SHA-1, SHA-256, SHA-384 or SHA-512 and shows the result in hex, Base64 and URL-safe Base64 as you type. It also verifies: paste the signature you expect and it tells you whether it matches.
HMAC is how two systems prove a message came from someone holding a shared secret and was not changed on the way. Developers reach for it when a payment provider's webhook fails verification and they need to know whether the secret, the body or the header is wrong, when writing a signing function and checking it against a known answer, or when an API document shows an example signature to reproduce.
When a webhook check fails, the usual cause is the body: the signature covers the exact raw bytes, and a JSON body re-serialised by a framework will not match. Related tools: JWT Decoder, Base64 Encoder, Bcrypt Hash and Verify.
The rest of the article, and all 6 questions about HMAC Generator, are on the HMAC Generator page.
Choose SHA-256, type or paste the secret key, then type the message or pick a file. The signature appears immediately in hex and Base64; press Copy next to the one your API expects. If your key is given as hex or Base64 rather than text, switch the key format first, because the same characters decode to different bytes.
Usually the body is not byte-for-byte what the sender signed: a framework parsed and re-serialised the JSON, changed line endings or trimmed whitespace. Sign the raw body. Other causes are using the wrong secret (test and live keys differ), treating a hex secret as text, or comparing hex against a Base64 signature.
A plain hash can be computed by anyone, so it proves nothing about who made it. HMAC mixes in a secret key, so only someone with the key can produce the right value. It is also built to resist length-extension attacks that break the naive approach of hashing the key followed by the message.
Text messages of any practical length and files up to 200 MB, because Web Crypto needs the whole message in memory. SHA-1, SHA-256, SHA-384 and SHA-512 are supported; MD5 is not available in Web Crypto and should not be used for new signatures anyway. Keys must be at least one byte.
Still stuck? Ask about HMAC Generator and anybody who knows can answer. No account needed.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry · Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
In the collection Security Tools for Developers.