HMAC-SHA256 Generator & Webhook Signature Verifier

What is HMAC?

HMAC (hash-based message authentication code) mixes a shared secret into a hash of the message. Only someone with the secret can produce the right value, and changing a single byte of the message changes the whole result. Webhook senders put the HMAC of the request body in a header; the receiver calculates it again over the raw body with the same secret and compares the two.

Try GitHub's documented test vector: secret It's a Secret to Everybody and body Hello, World! with the GitHub preset give sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17.

HMAC verification code

Verify on the server with the raw request body and a timing-safe compare. Both snippets check a sha256=<hex> header like GitHub's and splitforms'.

import { createHmac, timingSafeEqual } from "node:crypto";

// rawBody: the exact request bytes (a Buffer), not re-serialized JSON.
// header: e.g. req.headers["x-hub-signature-256"] = "sha256=<hex>"
export function verifySignature(rawBody, header, secret) {
  const received = Buffer.from(String(header).replace(/^sha256=/, ""), "hex");
  const expected = createHmac("sha256", secret).update(rawBody).digest();
  return received.length === expected.length && timingSafeEqual(received, expected);
}

import hashlib
import hmac

# raw_body: the exact request bytes, not re-serialized JSON.
# header: e.g. request.headers["X-Hub-Signature-256"] = "sha256=<hex>"
def verify_signature(raw_body: bytes, header: str, secret: str) -> bool:
    received = header.removeprefix("sha256=")
    expected = hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(received, expected)

For Stripe, Shopify and Slack code, see how to verify webhook signatures with HMAC.

HMAC and webhook signature FAQ

Related

• Verify webhook signatures with HMAC: the five provider schemes compared, with code.
• Webhook tester: catch a real request and see its headers and body.
• Form to webhook: send form submissions to your endpoint.
• Webhooks: how splitforms signs and delivers each submission.