HMAC-SHA256 Generator
Generate webhook signatures or verify Stripe, GitHub, and custom HMAC-SHA256 signatures.
HMAC-SHA256 hash Stripe / GitHub format (sha256=...)
Verify a signature
Uses constant-time comparison to prevent timing attacks.
About HMAC webhook signatures
How does Stripe webhook signature verification work?
Stripe constructs a signed payload:
timestamp + "." + raw_body. It computes HMAC-SHA256 of this string using your signing secret. The signature is in the Stripe-Signature header as t=timestamp,v1=signature. To verify: extract the timestamp, reconstruct the signed payload, compute your own HMAC, and compare to the v1 value.How does GitHub webhook signature verification work?
GitHub computes HMAC-SHA256 of the raw request body using your webhook secret. The result is in the
X-Hub-Signature-256 header as sha256=hexdigest. To verify: compute HMAC-SHA256 of the raw body with your secret, prepend sha256=, and compare using constant-time string comparison.Why use constant-time comparison?
Regular string comparison (
===) short-circuits on the first mismatched character, which can leak timing information to an attacker. Constant-time comparison always takes the same amount of time regardless of how many characters match, preventing timing attacks.What's the difference between HMAC and a plain SHA256 hash?
A plain SHA256 hash of a message can be computed by anyone — it provides no authentication. HMAC includes a secret key in the hash computation. Without the secret key, you can't reproduce the hash — which means an HMAC proves the message came from someone with the key.
Verifying webhook signatures in production?
HookDeploy captures and inspects every webhook payload with full headers, so you can debug signature issues in your real traffic.