HMAC Generator & Verifier

Quick Overview

The HMAC Generator computes HMAC-SHA256 and HMAC-SHA512 signatures using a secret key and a message payload, entirely within your browser. HMAC (Hash-based Message Authentication Code) is a cryptographic construct that combines a hash function with a shared secret to produce a signature that proves both the integrity of a message — that it has not been modified — and its authenticity — that it was produced by someone who knows the secret key. Unlike a plain hash, an HMAC cannot be forged without knowing the secret, making it the standard mechanism for securing webhooks and signing API requests.

Every major SaaS platform that delivers webhooks — GitHub, Stripe, Slack, Shopify, Twilio, and hundreds of others — uses HMAC-SHA256 signatures to allow receiving servers to verify that incoming HTTP requests genuinely came from the platform and were not injected by a third party. Understanding how to compute and verify these signatures is a fundamental skill for any backend engineer building integrations or for SREs responsible for securing event-driven infrastructure.

Technical Details

All HMAC computation uses the browser's native crypto.subtle.sign() API with the HMAC algorithm. The secret key is imported as a CryptoKey object using crypto.subtle.importKey(), which prevents the raw key bytes from being exposed to JavaScript code after import. The message and secret are encoded to UTF-8 bytes using the TextEncoder API before being passed to the cryptographic function. The resulting bytes can be formatted as lowercase hex, standard base64, URL-safe base64, or the sha256=hex prefixed format used by GitHub's webhook verification.

Common Use Cases

• Debugging webhook verification failures: Manually compute the expected HMAC signature for a captured webhook payload to identify whether the mismatch is caused by a wrong secret, incorrect encoding, or a payload transformation issue.
• Testing webhook integrations in development: Generate a valid signature for a test payload so you can send it with curl or Postman and verify your receiving endpoint's signature-checking logic works correctly before going to production.
• Learning the webhook security model: Interactively experiment with different secrets, algorithms, and output formats (hex, base64, prefixed) to understand how platforms like GitHub format their X-Hub-Signature-256 header.
• API request signing: Compute HMAC signatures for REST APIs that use signed request authentication, such as AWS Signature Version 4 or custom HMAC-based auth schemes.

Best Practices & Tips

Always sign the raw, unparsed request body bytes — not a re-serialized version of the JSON. If your webhook handler parses the body into an object and then re-serializes it before computing the comparison HMAC, differences in key ordering or whitespace between the original payload and your re-serialized version will produce a different signature and a false-negative verification failure; capture and sign the exact bytes as received, before any JSON parsing. Rotate webhook secrets on a schedule and support two active secrets during the rotation window (verify against either), since most platforms don't offer a zero-downtime secret rotation mechanism on their own. Store the secret in a secrets manager (Vault, AWS Secrets Manager, or your CI/CD platform's encrypted secrets) rather than an environment variable baked into a container image — a leaked image layer should not also leak your webhook secret. Finally, when troubleshooting a signature mismatch, check encoding before assuming the secret is wrong: a secret with a trailing newline (common when copy-pasted from a terminal or a `.env` file) produces a completely different HMAC than the same secret without it, and this is one of the most common causes of "valid secret but invalid signature" reports.

Frequently Asked Questions