Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Security

HMAC Generator & Verifier

· Last updated：2026-06-23

Compute an HMAC message-authentication signature over a message + shared secret using SHA-1/SHA-2/SHA-3/BLAKE2, or verify an incoming signature against the secret — with webhook presets for Stripe / Slack / GitHub and constant-time comparison

Details

What this tool helps you do

HMAC (Hash-based Message Authentication Code) proves a message was sent by someone who knows the shared secret and was not tampered with — it is the standard signature mechanism behind Stripe, Slack, GitHub, Shopify and most other webhooks.

This tool supports two modes:

  • Generate: paste the raw request body and your webhook secret, pick an algorithm (SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2s-256, BLAKE2b-512) and an output encoding (hex / base64 / base64url), and get the signature.
  • Verify: additionally paste the signature you received in the webhook header; the tool recomputes the HMAC and compares it in constant time via crypto.timingSafeEqual.

Webhook presets auto-select the right algorithm, encoding and signature prefix for Stripe, Slack, and GitHub. Everything is computed locally with Node crypto; the secret never leaves the request.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team
API35

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Security
Input types
textarea, text, select
Output type
html
Sample coverage
4
API ready
Yes

Overview

The HMAC Generator & Verifier allows you to compute and verify Hash-based Message Authentication Codes (HMAC) locally using algorithms like SHA-256, SHA-512, SHA-3, and BLAKE2. It features dedicated presets for Stripe, Slack, and GitHub webhooks, enabling you to generate signatures or verify incoming payloads in constant time to prevent timing attacks.

When to use

  • When debugging or testing webhook integrations from platforms like Stripe, Slack, or GitHub that require HMAC signature verification.
  • When generating secure API request signatures using shared secrets and hashing algorithms like SHA-256 or SHA-512.
  • When verifying the integrity and authenticity of a payload received from a third-party service without exposing your shared secret to external servers.

How it works

  1. 1Select your operation mode: either 'Generate only' to create a new signature, or 'Verify against signature' to validate an existing one.
  2. 2Input the raw request body (message) and your shared webhook secret, ensuring the payload is not re-serialized to avoid byte mismatches.
  3. 3Choose the hashing algorithm (such as SHA-256 or BLAKE2) and signature encoding (hex, base64, or base64url), or select a pre-configured webhook preset.
  4. 4The tool computes the HMAC locally using Node's crypto library and, if in verification mode, performs a constant-time comparison against your provided signature.

Use cases

  • Testing local webhook handlers by manually generating valid HMAC signatures for mock payloads.
  • Troubleshooting failed webhook signature verifications by comparing computed signatures against received headers.
  • Verifying API request authenticity during development using custom SHA-256 or SHA-512 HMAC configurations.

Examples

1. Verifying a Stripe Webhook Signature

Backend Developer

Background

A developer is integrating Stripe payments and needs to verify why their local webhook endpoint is rejecting Stripe's event payloads due to signature mismatches.

Problem

Manually verify if the received signature matches the raw JSON payload using the Stripe signing secret.

How to use

Set the mode to 'Verify against signature', select the 'Stripe' preset, paste the raw JSON payload into the message field, enter the Stripe signing secret, paste the signature from the header, and run the verification.

Mode: verify, Preset: stripe, Algorithm: sha256, Encoding: hex

Outcome

The tool performs a constant-time comparison and confirms whether the computed HMAC matches the signature provided in the Stripe header.

2. Generating a Slack Webhook Signature for Testing

QA Engineer

Background

A QA engineer wants to mock a Slack slash command request to test their application's signature validation logic.

Problem

Generate a valid Slack HMAC signature using the raw request body and the Slack signing secret.

How to use

FAQ

Does this tool send my shared secret to a server?

No. All HMAC computations and signature verifications are performed locally in your browser using Node crypto APIs.

Why does my generated signature not match the webhook signature?

Ensure you are pasting the exact raw request body. Re-serializing JSON or adding whitespace changes the byte sequence, which alters the HMAC output.

What is constant-time comparison?

It is a security measure that compares signatures byte-by-byte at a constant speed, preventing attackers from using timing analysis to guess the signature.

Which algorithms are supported?

The tool supports SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, BLAKE2s-256, and BLAKE2b-512.

What do the webhook presets do?

They automatically configure the correct hashing algorithm, output encoding, and signature prefix format used by Stripe, Slack, or GitHub.

Hub

Authorized JWT, OTP, TOTP, and Session Test Workflow

Build sanitized auth fixtures, separate token generation from decoding and verification, test OTP/TOTP timing, and audit JWT and session evidence without exposing real secrets.

Hub

API Request Format, Replay Preparation, and Debugging Tools

Check request structure, prepare a local replay, compare responses, and debug API clues. These tools analyze or generate locally and do not replace real authentication or server tests.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Java

Android Image Processing Java Samples

Android Java image processing examples including reading/saving images, scaling, and format conversion

Kotlin

Android Image Processing Kotlin Samples

Android Kotlin image processing examples including reading/saving images, scaling, and format conversion

Python

Web Image Processing Python Samples

Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

Rust

Web Image Processing Rust Samples

Web Rust image processing examples including image read/save, scaling, and format conversion

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Security

SSH Key Pair Generator

Generate an SSH key pair (Ed25519 recommended, RSA 4096, or ECDSA P-256) with an OpenSSH-format public key ready for ~/.ssh/authorized_keys, a SHA256 fingerprint, and a PEM private key. Optional passphrase encryption. Runs locally.

Security

TOTP / HOTP Offline Code Generator

Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy

Security

BIP39 Mnemonic Phrase Generator

Generate or validate 12 to 24 word BIP39 mnemonic phrases with entropy and PBKDF2-HMAC-SHA512 seed output

Select the 'Slack' preset, paste the raw request payload into the message field, input the Slack signing secret, and generate the signature.

Mode: generate, Preset: slack, Algorithm: sha256, Encoding: hex

Outcome

The tool outputs the correct HMAC signature prefixed with 'v0=', ready to be used in the 'X-Slack-Signature' header of the test request.