Tool
Hash and HMAC playground
Hash or sign a message with any algorithm PHP supports, and compare two digests the way your code should.
Signature mismatches are miserable to debug, because both sides look right and the only evidence is that they disagree. Being able to compute the same digest by hand — with your key, your exact message, the same algorithm — usually finds it in a minute.
The most common cause is not the algorithm. It is that the two sides are signing different bytes: one includes a trailing newline, one uses a different parameter order, one URL-encodes before signing and the other after.
The compare box uses hash_equals, which is what your own code should use.
$sig = hash_hmac('sha256', $message, $secret);
if (!hash_equals($expected, $received)) {
// reject: not signed with your key
}Notes
Compare digests with hash_equals, never with == or ===. String comparison short-circuits on the first differing byte, and that timing difference leaks how much of a guess was right.
MD5 and SHA-1 are here because you will meet them in other people's APIs, not because you should choose them. For anything new, HMAC-SHA256.
An HMAC with an empty key is not an error and not a signature. If your secret is not loading, this is what it looks like.
Sign the exact bytes you transmit. Sign the string after any encoding, not before.