Question 1

What is an HMAC signature?

Accepted Answer

An HMAC (Hash-based Message Authentication Code) signature is a hash computed from a request body and a shared secret. Webhook providers like GitHub, Stripe and Shopify send it in a header so you can verify the request is authentic and unmodified.

Question 2

How do I verify a webhook signature?

Accepted Answer

Compute an HMAC of the raw request body using the shared secret and the provider's algorithm (usually SHA256), then compare it to the signature in the request header. If they match, the webhook is authentic. Paste the body, secret and expected signature into this tool to check.

Question 3

Which algorithm should I use?

Accepted Answer

Most providers use SHA256. GitHub uses SHA256 (X-Hub-Signature-256), Stripe uses SHA256, and Shopify uses SHA256 (base64). This tool supports SHA256, SHA512, SHA1 and MD5.

Tunnels

Webhooks

User Management

HMAC Generator & Webhook Signature Verifier