HMAC Generator & Signature Verifier
Compute keyed message authentication codes for API payloads, webhook integrations, and data integrity verification using hardware-accelerated client-side cryptography.
Live Signature Verification
Test whether a received webhook signature header matches the calculated HMAC.
Understanding HMAC & Webhook API Security
1. Authentication + Integrity
Unlike ordinary hashing, an HMAC (Keyed-Hash Message Authentication Code) mixes a shared secret key with the message via two passes of hash compression. It proves that the sender possesses the secret and that the data was not modified in transit.
2. Webhook Signatures (GitHub / Stripe)
When external platforms send webhooks to your server, they include an HMAC signature header (like X-Hub-Signature-256 or Stripe-Signature). Your backend recalculates the HMAC using the raw incoming body to verify authenticity.
3. Preventing Replay Attacks
Best practice protocols pair the HMAC signature with a timestamp header (e.g. timestamp.payload). If an attacker intercepts the request, your backend rejects any signed payload older than a 5-minute tolerance window.
Developer Notice: Always Use Constant-Time String Comparison
When validating webhook signatures on production servers (such as Node.js, Go, or Python), never use standard string equality operators (a === b). Standard comparisons exit early on the first mismatched byte, creating exploitable timing side-channel attacks. Always use constant-time primitives like crypto.timingSafeEqual().