HMAC Generator & Verifier

What is HMAC and why is it used for webhook verification?

A Hash-based Message Authentication Code (HMAC) is a cryptographic authentication technique that verifies both the data integrity and the authenticity of a message. While standard cryptographic hashes (such as SHA-256 or MD5) can verify that data has not accidentally changed, anyone can recalculate a standard hash for altered data. An HMAC solves this by combining the message with a cryptographic secret key known only to the sender and the receiver.

Whenever a third-party service (such as Stripe, GitHub, Shopify, Slack, or ProWebLook) triggers an asynchronous HTTP POST webhook to your server, your application must ensure that the request genuinely originated from the service and was not intercepted or forged by a malicious actor. The provider signs the raw HTTP body with your shared webhook secret, placing the resulting HMAC in an HTTP request header (such as Stripe-Signature or X-Hub-Signature-256).

How to verify webhook signatures securely

1. Capture the raw request body: Always calculate the HMAC over the exact, unparsed raw bytes or string received by your server. Parsing the payload into JSON and re-serializing it can change whitespace, line endings, or key order, resulting in an invalid signature mismatch.
2. Retrieve the shared secret: Read your webhook signing secret from secure server environment variables (never hardcoded in source code).
3. Compute the HMAC: Use your language’s native cryptographic library (e.g. hash_hmac('sha256', $payload, $secret) in PHP, or crypto.createHmac('sha256', secret).update(payload).digest('hex') in Node.js).
4. Use constant-time string comparison: Never compare cryptographic signatures with standard equality operators (=== or ==). Standard comparisons exit early on the first mismatched byte, creating measurable timing discrepancies that attackers can exploit via side-channel attacks. Always use constant-time functions like hash_equals() in PHP, crypto.timingSafeEqual() in Node.js, or hmac.compare_digest() in Python.

Hexadecimal vs. Base64 encoding

An HMAC calculation produces a raw binary byte array (typically 32 bytes for SHA-256 or 64 bytes for SHA-512). To transmit this binary signature inside an HTTP text header, providers encode the bytes:

• Hexadecimal (Hex): Represents each byte as two characters (0-9, a-f). Common in GitHub (sha256=...), Stripe (v1=...), and AWS.
• Base64: Encodes bytes into standard ASCII using characters A-Z, a-z, 0-9, +, and / with = padding. Common in Shopify and Google Cloud Pub/Sub.
• Base64URL: URL-safe Base64 that replaces + with - and / with _, omitting padding. Standard in JWT (JSON Web Tokens).

Client-side privacy: Zero network exposure

This generator runs 100% locally in your web browser using the W3C Web Cryptography API (window.crypto.subtle). Your shared webhook secret keys, production payload data, and generated signatures are never transmitted over the internet, keeping your credentials secure.