# HMAC Generator & Verifier

Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison

> Canonical page: https://elysiatools.com/en/tools/hmac-generator-verifier

- **Category:** Security

- **Keywords:** hmac, signature, webhook, stripe, slack, github, sha256, sha-2, sha-3, blake2, message authentication code, mac, verify, api signing, security

## Overview

HMAC (Hash-based Message Authentication Code) proves a message was sent by someone who knows the shared secret and was not tampered with — it is the standard signature mechanism behind Stripe, Slack, GitHub, Shopify and most other webhooks.

This tool supports two modes:

- **Generate**: paste the raw request body and your webhook secret, pick an algorithm (SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2s-256, BLAKE2b-512) and an output encoding (hex / base64 / base64url), and get the signature.
- **Verify**: additionally paste the signature you received in the webhook header; the tool recomputes the HMAC and compares it in constant time via `crypto.timingSafeEqual`.

Webhook presets auto-select the right algorithm, encoding and signature prefix for Stripe, Slack, and GitHub. Everything is computed locally with Node `crypto`; the secret never leaves the request.

## Inputs

- **Message (raw body)** (textarea): Paste the raw request body exactly as received (do not re-serialize JSON — byte differences break the signature).
- **Shared Secret** (text): whsec_... (your webhook signing secret)
- **Mode** (select)
- **Algorithm** (select)
- **Signature Encoding** (select)
- **Signature to verify** (text): Paste the signature from the webhook header (verify mode)
- **Webhook preset** (select)

## When to use

- When debugging or testing webhook integrations from platforms like Stripe, Slack, or GitHub that require HMAC signature verification.
- When generating secure API request signatures using shared secrets and hashing algorithms like SHA-256 or SHA-512.
- When verifying the integrity and authenticity of a payload received from a third-party service without exposing your shared secret to external servers.

## How it works

- Select your operation mode: either 'Generate only' to create a new signature, or 'Verify against signature' to validate an existing one.
- Input the raw request body (message) and your shared webhook secret, ensuring the payload is not re-serialized to avoid byte mismatches.
- Choose the hashing algorithm (such as SHA-256 or BLAKE2) and signature encoding (hex, base64, or base64url), or select a pre-configured webhook preset.
- The tool computes the HMAC locally using Node's crypto library and, if in verification mode, performs a constant-time comparison against your provided signature.

## Use cases

- Testing local webhook handlers by manually generating valid HMAC signatures for mock payloads.
- Troubleshooting failed webhook signature verifications by comparing computed signatures against received headers.
- Verifying API request authenticity during development using custom SHA-256 or SHA-512 HMAC configurations.

## Frequently asked questions

### Does this tool send my shared secret to a server?

No. All HMAC computations and signature verifications are performed locally in your browser using Node crypto APIs.

### Why does my generated signature not match the webhook signature?

Ensure you are pasting the exact raw request body. Re-serializing JSON or adding whitespace changes the byte sequence, which alters the HMAC output.

### What is constant-time comparison?

It is a security measure that compares signatures byte-by-byte at a constant speed, preventing attackers from using timing analysis to guess the signature.

### Which algorithms are supported?

The tool supports SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2s-256, and BLAKE2b-512.

### What do the webhook presets do?

They automatically configure the correct hashing algorithm, output encoding, and signature prefix format used by Stripe, Slack, or GitHub.

## Related tools

- [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.
- [SSH Key Pair Generator](https://elysiatools.com/en/tools/ssh-key-generator): Generate an SSH key pair (Ed25519 recommended, RSA 4096, or ECDSA P-256) with an OpenSSH-format public key ready for ~/.ssh/authorized_keys, a SHA256 fingerprint, and a PEM private key. Optional passphrase encryption. Runs locally.
- [TOTP / HOTP Offline Code Generator](https://elysiatools.com/en/tools/totp-hotp-offline-generator): Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy
- [BIP39 Mnemonic Phrase Generator](https://elysiatools.com/en/tools/mnemonic-bip39-generator): Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output
- [Text Hash Generator](https://elysiatools.com/en/tools/text-hash-generator): Compute MD5, SHA-1, SHA-256, SHA-512, and CRC-32 hashes of any text in one shot. Get both hex and Base64 digests over the UTF-8 encoding.
- [Argon2 Password Hash Generator](https://elysiatools.com/en/tools/argon2-password-hash-generator): Generate Argon2id password hashes with tunable memory, iterations, parallelism, salt length, and PHC output
- [Barcode Batch Generator](https://elysiatools.com/en/tools/barcode-batch-generator): Batch generate Code 128, EAN-13, UPC-A, ITF-14, QR Code, and Data Matrix outputs from CSV or multiline text
- [Entropy Calculator](https://elysiatools.com/en/tools/entropy-calculator): Measure the randomness of any data — Shannon entropy (bits/symbol), Min-Entropy (worst-case guess work), alphabet size, duplicate rate, and an average brute-force cracking time at a chosen hash rate. Rates data as Strong (≥128-bit min-entropy), Medium (64-127), or Weak (<64).

## Samples

- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Web Image Processing Rust Samples](https://elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion

## Related content

- [API Request Replay, Snippet, and Runtime Debugging Tools](https://elysiatools.com/en/hubs/api-request-replay-and-debugging): Turn broken HTTP calls into reproducible cases with cURL-to-code converters, webhook capture and replay, HMAC verification, response diffing, header audits, TLS inspection, and request-path debugging tools.
- [Token, Session, and 2FA Workflow Tools](https://elysiatools.com/en/hubs/token-session-and-2fa-workflows): Debug real sign-in flows with PKCE and nonce generators, JWT and JWK inspectors, HMAC verification, OTP and TOTP testing, and auth-safe identifiers collected in one focused workflow hub.
- [JSON Schema, Mock Data, and API Fixture Generators](https://elysiatools.com/en/hubs/json-generate): Curated tools for JSON schema generation, mock payload building, and API fixture preparation in one hub.
- [CSS Effects, Palettes, and Design Token Generators](https://elysiatools.com/en/hubs/design-generate): Curated tools for CSS visual effects, palette building, and design token generation in one hub.