HMAC explained.
HMAC (Hash-based Message Authentication Code) is a way to sign data with a shared secret key so the receiver can confirm both who sent the message and that it has not been changed.
How HMAC works
A plain hash like SHA-256 turns any input into a fixed-length fingerprint, but anyone can compute it, so on its own it proves nothing about who made it. HMAC adds a secret key into the hashing so that only someone who holds that key can produce a valid result.
The sender mixes the message with the shared secret in a specific, standardized way and runs it through the hash function, producing a short code, then sends that code alongside the message. The receiver, who holds the same secret, repeats the calculation over the message it got and compares the two codes with a constant-time check. A match means the message is authentic (only a key holder could have made the code) and intact (any edit to the message changes the code). Because it needs only a shared secret and a hash function, HMAC is fast and everywhere.
For a form backend it's the engine behind a webhook signature: FormWire computes an HMAC of each webhook body with your secret so your endpoint can prove the request really came from FormWire.
What HMAC combines.
A shared secret
Both sides hold the same key and nobody else does, so producing a valid code is proof of holding it.
A hash function
A one-way function like SHA-256 turns the keyed message into a short fingerprint that can't be reversed or forged without the key.
A signature to verify
The receiver recomputes the code and compares, the exact mechanism behind a webhook signature.
Related questions
No. Encryption hides the contents of a message so only the intended party can read it; HMAC leaves the message readable and instead proves who produced it and that it wasn't altered. They solve different problems and are often used together, since a webhook is sent over HTTPS for privacy and signed with HMAC for authenticity.
A plain hash proves integrity but not identity: anyone can hash a forged message and send the matching fingerprint. HMAC folds a secret key into the hash, so only a party that holds the key can produce a code that verifies, which is what lets a receiver trust the sender.
How FormWire signs webhooks →A modern, collision-resistant one. SHA-256 is the common choice and the basis of HMAC-SHA256. The construction inherits its strength from the underlying hash, so older, broken functions should be avoided even though HMAC is more resilient than using them bare.
Every webhook FormWire sends carries an HMAC of the raw request body, keyed with your webhook secret, in a signature header. Your handler recomputes it over the exact bytes received and compares, which proves the request came from FormWire and wasn't tampered with in transit.
Want to see it working?
Read the docsHow FormWire fills the role.
Verify every signed request.
Free tier forever. No credit card required.