HMAC SHA256 / SHA512 Signature Generator

RFC 2104

Calculate and verify Keyed-Hash Message Authentication Codes (HMAC) for webhook signing (Stripe, GitHub, Shopify, Slack, Twilio) directly in browser memory. Supports SHA-256, SHA-512, SHA-384, SHA-1, and MD5 with zero server transmission.

Cryptographic AlgorithmWeb Crypto API

Digest Output FormatHexadecimal

Quick Presets1-Click Load

Shared Secret Key

46 bytes(368 bits)Industry Standard (256 bits)

Message / Raw Payload

381 chars•381 bytes•18 lines

Calculated HMAC-SHA-256

0 ms•0 chars

Enter secret key and message to calculate signature...

Encoding: hex-lower

Multi-Format Encodings

Instant One-Click Copy

Hex (lowercase)

HEX (uppercase)

Base64 (Shopify / Twilio)

Base64URL (URL-Safe)

Ready-to-Use Webhook Headers

Live Simulated

GitHub (X-Hub-Signature-256)

sha256=

HMAC-SHA256 hex digest prefixed with sha256=

Stripe (Stripe-Signature)

t=1791765875,v1=

Concatenated timestamp t and v1 hex signature

Shopify (X-Shopify-Hmac-Sha256)

HMAC-SHA256 encoded directly in standard Base64

Slack (X-Slack-Signature)

v0=

Prefixed with v0= and computed on v0:timestamp:body

How HMAC Authentication Works

HMAC uses a two-pass hash calculation defined in RFC 2104: H((K ⊕ opad) || H((K ⊕ ipad) || M)). Inner and outer padding masks prevent length-extension attacks that cripple standard hash concatenation.

Preventing Replay Attacks

Top providers like Stripe and Slack prepend a Unix timestamp (e.g. t.payload) into the signed string. Always reject webhooks older than 5 minutes to render network-sniffed replays useless.

Timing-Safe String Comparison

Standard comparisons (==) return false on the first mismatch. Use crypto.timingSafeEqual() or hmac.compare_digest() to avoid sub-microsecond timing leak side-channel attacks.

Webhook Signature Specifications Comparison

Service	Algorithm	HTTP Header Name	Output Encoding	Payload Format
GitHub	HMAC-SHA256	X-Hub-Signature-256	Hex (sha256=...)	Raw request body
Stripe	HMAC-SHA256	Stripe-Signature	Hex (t=...,v1=...)	Timestamp + '.' + Raw body
Shopify	HMAC-SHA256	X-Shopify-Hmac-Sha256	Base64	Raw request body
Slack	HMAC-SHA256	X-Slack-Signature	Hex (v0=...)	v0 + ':' + Timestamp + ':' + Body
Twilio	HMAC-SHA1	X-Twilio-Signature	Base64	Full URL + Sorted POST params
AWS SigV4	HMAC-SHA256	Authorization	Hex lower	Derived signing key + string-to-sign