Verify an HMAC signature locally

Use this HMAC verifier to compare an expected signature with one generated from a message, shared secret, algorithm, and output format. It is useful for debugging webhook signatures and signed request integrations.

How it works

  1. Paste the exact message bytes or text used by the sender.
  2. Choose the matching digest algorithm and enter the shared secret.
  3. Paste the expected signature and compare the generated result with the supplied value.

Capabilities and limits

  • Supports common HMAC digest algorithms and output formats.
  • Helps identify mismatches caused by encoding, whitespace, or wrong secrets.
  • Requires the original message and shared secret; an HMAC cannot be verified with a public key.

Examples

Webhook payload

message: {"event":"invoice.paid"}
algorithm: SHA-256
output: hex

Use the raw payload exactly as received; reformatting JSON changes the signature.

Simple test value

message: hello
secret: shared-secret
algorithm: SHA-256

Compare this generated value with a signature from your integration test.

Frequently asked questions

Why does a valid-looking signature fail?

The message encoding, line endings, secret, digest algorithm, or hex/Base64 output format may differ from the sender’s values.

Can HMAC decrypt data?

No. HMAC verifies integrity and authenticity with a shared secret; it is not encryption.