About the HMAC Generator
HMAC proves that a message came from someone who knows a shared secret and that it was not changed on the way. Web services use it to sign webhooks, API requests and cookies. This generator takes a secret key and a message, runs HMAC with SHA-256, SHA-512, SHA-384 or SHA-1 and shows the signature in hex and in Base64. There is also a box where you can paste the signature you received, and the page tells you if it matches. Everything is computed in your browser with the Web Crypto API, so the key and message stay on your device. Use test keys, not live production secrets.
Updated October 2026
How to use the HMAC Generator
- 1Choose the hash function, for example HMAC-SHA256.
- 2Type the secret key.
- 3Paste or type the exact message that was signed.
- 4Copy the signature in hex or Base64.
- 5To verify a webhook, paste the signature you received into the check box.
What HMAC protects
Imagine a payment service that sends your site a notice when a customer pays. Without a signature, anyone could post a fake notice to your address. The service therefore signs each notice with a secret you both know. Your server repeats the calculation and accepts the notice only when the results match.
Because the secret is never sent, an attacker who sees the message cannot make a valid signature for a changed message. They would have to guess the key, which is why long random keys matter.
Getting a match
- Sign the raw bytes exactly as received, not a re-formatted copy.
- Use the same text encoding on both sides, normally UTF-8.
- Check whether the service wants hex or Base64.
- Some services sign a timestamp plus the body, so build the string in their order.
- Compare signatures in constant time in your own code.
Related tools
The JWT Generator uses HMAC to sign tokens, and the JWT Decoder shows what a token contains. For an unkeyed digest of a file or text use the Hash Generator, and for the longer SHA-3 family try the SHA-3 and RIPEMD-160 Hash Calculator. If the signature arrives in Base64, the Base64 Encoder & Decoder can convert it. Never share your real signing secret in chat or tickets.
Features
- HMAC-SHA256, SHA512, SHA384 and SHA1
- Hex and Base64 signatures
- Check a received signature
- Updates as you type
- Handles Unicode text correctly
- Uses the Web Crypto API in your browser
- No upload, no sign-up
Frequently asked questions
What is HMAC?
HMAC stands for hash-based message authentication code. It combines a secret key with a hash function to make a signature that only someone with the key can create or check.
Is HMAC the same as a hash?
No. A plain hash such as SHA-256 has no key, so anyone can compute it. HMAC needs the secret, which is why it can prove who made the message.
How do I verify a webhook signature?
Compute the HMAC of the exact raw request body with your signing secret and compare it with the signature header. Even one extra space or newline in the body changes the result.
Why does my signature not match?
Common causes are a different key, a body that was parsed and re-serialised, extra whitespace, a different hash function or comparing hex with Base64. This tool checks both formats.
Which hash function is best?
SHA-256 is the common default. SHA-1 is still accepted for HMAC by some services, but prefer SHA-256 or SHA-512 where you can.
Is HMAC encryption?
No. The message is not hidden. HMAC only proves origin and integrity.
Is my key sent anywhere?
No, the calculation uses your browser. Still, treat any website as untrusted for real production keys and use test keys when you experiment.