[{"data":1,"prerenderedAt":29},["ShallowReactive",2],{"content-hmac-generator-en":3},{"about":4,"steps":8,"faq":13},[5,6,7],"An HMAC (hash-based message authentication code, RFC 2104) is a signature made from a message and a secret key. Anyone who knows the key can verify that the message is unchanged and comes from the sender. Webhooks from GitHub, Stripe, Shopify or Slack, signed API requests and JWTs with HS256 all use this scheme.","The HMAC generator calculates the signature with SHA-1, SHA-256, SHA-384 and SHA-512 at once, as hex, Base64 or Base64URL. You can enter the key as text, hex or Base64. Paste a received signature and the tool instantly tells you whether it is valid – also with a prefix like “sha256=”.","Everything is calculated with your browser’s Web Crypto API. Message and key are not uploaded and never end up in the URL.",[9,10,11,12],"Enter the message, e.g. the raw body of a webhook.","Enter the secret key and choose whether it is text, hex or Base64.","Pick the output (hex, Base64 or Base64URL) and copy the signature of the algorithm you need.","To verify, paste the received signature under “Verify a signature”.",[14,17,20,23,26],{"q":15,"a":16},"What is the difference between an HMAC and a plain hash?","Anyone can calculate a plain hash like SHA-256; it only proves that data is unchanged. An HMAC also depends on the secret key: without the key nobody can create a valid signature. Plain checksums are calculated by the [[hash-generator]].",{"q":18,"a":19},"Why does my webhook signature not match?","Usually the exact raw body is not what was signed: re-formatted JSON, a different line ending or a missing space all change the signature. Also check whether the provider uses hex or Base64 and whether the key is plain text or encoded. Some services sign more than the body, for example a timestamp and the body together.",{"q":21,"a":22},"Is HMAC-SHA-1 still secure?","As an HMAC, yes: the known collision attacks on SHA-1 do not break HMAC-SHA-1. For new systems HMAC-SHA-256 is still the usual standard.",{"q":24,"a":25},"How long should the key be?","At least as long as the hash output, so 32 random bytes for HMAC-SHA-256. You can create a random key with the [[password-generator]] (long random passwords).",{"q":27,"a":28},"Is my key stored or sent anywhere?","No. The calculation runs entirely in your browser. Only the chosen formats go into the URL, never the message or the key. In the Studio this block also runs only in the browser; the API deliberately does not offer it.",1792518996775]