devopscodepro
Language
Productized services
Infrastructure AuditRisks, costs and quick wins — mapped in two weeks.Cloud Migration & IaCTerraform, CI/CD and a zero-downtime cutover.Monitoring-as-a-ServiceAlerting, on-call and incident response.Fractional DevOpsA senior engineer in your team, part-time.
Not sure where to start? The audit answers that.Request a quote →
server-assisted · every other tool runs in your browserAll 41 tools →
Infrastructure AuditCloud Migration & IaCMonitoring-as-a-ServiceFractional DevOps
ContactLog in
Request a quote
Theme
Language
Runs entirely in your browser — nothing leaves this page.

HMAC generator

HMAC signatures for webhook debugging: pick the algorithm, paste the secret, compare against the signature a provider sent.

Enter a secret key and a message to compute the signature.
These tools show symptoms. A full infrastructure audit finds the causes — risks, cost leaks and single points of failure, mapped in two weeks.
Request a quote →

Debugging webhook signatures

Stripe, GitHub, Shopify and practically every webhook provider sign their payloads with HMAC: hash the raw body with a shared secret, send the result in a header. When your verification fails, this tool shows you what the signature should have been — paste the secret, paste the body, compare with what arrived.

The comparison field understands the formats providers actually send: plain hex, a sha256=… prefix (GitHub), or base64 (Shopify). The check is constant-time, and the verdict is a simple match or no match.

Everything runs in your browser. Pasting a webhook secret into a page that sends it to someone's server defeats the point of a secret — here the network tab stays empty.

My computed HMAC doesn't match the provider's. What's wrong?

Almost always the message. HMAC is computed over the exact raw bytes of the request body — a JSON body re-serialized by your framework, a stripped newline or a different Unicode normalization changes the digest. Verify against the raw body, before any parsing.

Which encoding do I pick for the key?

How the provider gives it to you. A Stripe whsec_… secret is used as the literal UTF-8 string; some providers hand you hex or base64 that must be decoded to bytes first. The wrong choice gives a consistent but wrong signature.

Is HMAC-SHA-256 still safe? Should I use SHA3?

HMAC-SHA-256 is not broken and is not close to being broken — the HMAC construction even keeps MD5 and SHA-1 variants unforgeable in practice, though nobody should introduce those today. SHA3 variants exist here for systems that standardized on them, not because SHA-2 needs replacing.

Why constant-time comparison?

Comparing signatures byte-by-byte with early exit leaks how many leading bytes matched through response timing, which lets an attacker forge a signature one byte at a time. Your server-side check should use a constant-time compare too — most frameworks ship one.

Related tools: Hash & checksum, JWT decoder and Encrypt / decrypt.