HMAC Generator
Sign a message or file with a secret key using HMAC-SHA256, SHA-1, SHA-384 or SHA-512. Choose hex or Base64 output, and paste a signature to check whether it matches, for example from a webhook header.
How to generate an HMAC
- Type or paste the message, or switch to File to sign a file’s exact bytes.
- Enter the secret key and pick its format: plain text, hex or Base64. Choose the algorithm, usually HMAC-SHA256.
- Copy the signature in hex or Base64. To verify a webhook, paste the signature from its header into “Check a signature”.
What is an HMAC?
A hash-based message authentication code (HMAC, RFC 2104) combines a message with a secret key to produce a signature. Anyone with the key can recompute it; anyone without the key cannot forge it. Change one character of the message or the key and the signature changes completely. That makes HMAC the standard way to prove a request really came from who it claims, and was not altered on the way.
Verifying webhooks
Payment providers, Git hosts and messaging platforms sign webhook requests with HMAC-SHA256 and send the result in a header, sometimes with a prefix such as sha256=. To verify, compute the HMAC of the raw request body exactly as received, with your webhook secret, and compare. The checker here accepts hex or Base64 and ignores common prefixes.
The most common reason signatures do not match is that the body was changed before signing: parsed and re-serialized JSON, a trailing newline, different spacing, or a different character encoding. Some services also sign a combination such as a timestamp plus the body; check their documentation for the exact string.
Which algorithm should I use?
HMAC-SHA256 is the usual choice and is secure for signing. HMAC-SHA1 is still safe as an HMAC (the known SHA-1 weaknesses do not break HMAC) but is only used for older systems. SHA-384 and SHA-512 give longer signatures for stricter requirements. MD5 is not offered because browsers’ built-in cryptography does not support it.
Need a different tool? Suggest it here — we read every message.
Frequently asked questions
Is HMAC the same as a hash?
No. A plain hash such as SHA-256 has no key, so anyone can compute it. An HMAC needs the secret key, so only someone with the key can produce a valid signature.
Why does my signature differ from the server’s?
Usually the message bytes differ: whitespace, line endings, JSON formatting or encoding. The key format matters too: a key shown as hex must be entered as hex, not as text.
Can I sign a file?
Yes. Choose File and pick any file; its exact bytes are signed, which is useful for checking downloads or API uploads.
Is my key safe?
The key never leaves your browser; signatures are computed with the built-in Web Crypto API. Even so, avoid pasting production secrets into any tool you do not need to.
Is anything sent to a server?
No. Everything is calculated in your browser, and nothing you enter leaves your device.