API & Secret Key Generator
rxd_live_f1ac4a61e5e57c4a3abad8697fc20c80
About HMAC Verifier
The HMAC Signature Verifier checks Keyed-Hash Message Authentication Codes (HMAC-SHA256, HMAC-SHA512, HMAC-SHA1) against expected webhook payloads (Stripe, GitHub, Shopify, Slack) using constant-time comparison to prevent timing attacks.
How to Use HMAC Verifier
Step 1
Select the HMAC algorithm and input your secret key.
Step 2
Paste the raw message / webhook payload and expected signature.
Step 3
Click "Verify Signature".
Step 4
Inspect the validation match badge (MATCH / MISMATCH).
Practical Use Cases for HMAC Verifier
Webhook Signature Verification (Stripe, GitHub, Shopify)
Verify incoming webhook HTTP payloads against `Stripe-Signature` or `X-Hub-Signature-256` headers to confirm payload authenticity.
API Request Authentication & Debugging
Debug API client signature generation by testing message payloads and secret keys against standard HMAC outputs.
Input & Output Examples
Verifying GitHub Webhook Payload Signature
Algorithm: HMAC-SHA256, Secret: "webhook_secret", Message: "payload_data", Expected: "7f8b9a..."
Result: MATCH (Valid Signature) | Computed Hash: 7f8b9a... | Constant-Time Comparison: OK
Key Features & Performance
- ✓Supported algorithms: HMAC-SHA256, HMAC-SHA512, HMAC-SHA384, HMAC-SHA1, and HMAC-MD5.
- ✓Supports Hex, Base64, and Base64URL signature encodings.
- ✓Constant-time comparison prevents timing side-channel attacks.
- ✓100% Client-Side memory execution guarantees webhook secret privacy.
- ✓1-Click Copy verification report.
Key Terminology & Definitions
HMAC (Hash-based Message Authentication Code)
A cryptographic authentication mechanism combining a cryptographic hash function with a secret shared key to verify both data integrity and message authenticity.
Constant-Time Comparison
A string comparison technique that takes the exact same number of clock cycles regardless of where characters differ, preventing timing attacks.