HMAC Generator
Compute and verify HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures.
Sign A Message, Or Prove A Webhook Is Genuine
An HMAC is a keyed hash: it proves a message came from someone holding the secret key and was not altered on the way. It is how Stripe, GitHub, Shopify and Slack sign the webhooks they send you, and how many APIs sign requests.
Enter the message and the key — as text, hex or base64 — and get the HMAC in hex and base64 for SHA-1, SHA-256, SHA-384 or SHA-512. Paste a signature you received to check it: the comparison accepts hex or base64 and ignores a sha256= prefix.
Key features
- Four hashes — HMAC-SHA1, SHA-256, SHA-384 and SHA-512.
- Key and message formats — plain text, hex or base64.
- Hex and base64 output, side by side.
- Signature verifier for webhook debugging.
- WebCrypto — computed by your browser; the key never leaves the tab.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: HMAC Generator
- Paste the message
For a webhook, the raw request body exactly as it arrived. - Enter the key
Your webhook signing secret or API secret. - Choose the hash
Most services use SHA-256. - Compare
Paste the signature header to see if it matches.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Why does my webhook signature not match?
Almost always because the body was changed before hashing — parsed and re-serialised JSON has different spacing or key order. Hash the raw bytes exactly as received. Also check the secret, the hash and whether the service signs a timestamp together with the body, as Stripe and Slack do.
Is HMAC the same as a hash?
No. A plain SHA-256 hash can be computed by anyone. An HMAC mixes in a secret key, so only someone with the key can produce or check it.
Is HMAC-SHA1 still safe?
For HMAC, yes — the collision attacks on SHA-1 do not break HMAC-SHA1. For new systems, SHA-256 is the sensible default.
Hex or base64?
They are the same bytes written two ways. GitHub sends hex with a sha256= prefix; Shopify sends base64. The verifier here accepts either.
Can I compare signatures with == in my code?
Use a constant-time comparison such as crypto.timingSafeEqual in Node or hmac.compare_digest in Python, so the time taken does not leak how many characters matched.