HMAC Signature Generator & Verifier
How webhooks use HMAC
Webhook providers sign payloads using a shared secret so you can verify the request is authentic. Mitte automatically validates HMAC signatures on your incoming webhooks.
Frequently Asked Questions
What is HMAC and why do I need it?
HMAC (Hash-based Message Authentication Code) is a cryptographic method to verify both data integrity and authenticity. Webhook providers like Stripe, GitHub, and Shopify use HMAC signatures so your server can confirm the request is genuine and hasn't been tampered with.
Is my secret key safe in this tool?
Yes. This HMAC generator uses the Web Crypto API built into your browser. Your secret key and payload never leave your device — no data is sent to any server.
Which HMAC algorithm should I use?
SHA-256 is the most common for webhook signatures (used by Stripe, GitHub, Slack). SHA-512 offers a longer hash for higher security. SHA-1 is legacy and less recommended but still used by some services.
How do I verify a webhook signature?
Switch to the Verify tab, enter the payload and secret from your webhook provider, paste the signature from the request header, and click Verify. The tool will compute the expected HMAC and compare it to the provided signature.