HMAC Generator

Generate keyed HMAC signatures for webhooks and API requests.

Text to hash

Use HMAC with a secret key

HMAC proves authenticity as well as integrity.

Uppercase output

Highlighted algorithm

Compare against an expected hash

Comparison ignores case.

What does HMAC Generator do?

Compute HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512 and a secret key. HMAC is what proves a webhook genuinely came from the sender, and what signs API requests where a bearer token is not enough.

How to Use HMAC Generator

1
Enter the messageThe exact payload bytes that were signed.
2
Enter the secret keyUse a test key rather than a production one.
3
Choose the algorithmSHA-256 is by far the most common.
4
Compare or copyPaste an expected signature to verify a match.

Key Features

SHA-1, SHA-256, SHA-384 and SHA-512 algorithms
Hex and Base64 output
Verification mode that compares against an expected signature
Computed with Web Crypto, so results match any server-side library
Explains why HMAC is not the same as a plain hash of key plus message

Frequently Asked Questions

What is HMAC used for?

Proving both integrity and origin. A webhook provider signs the payload with a shared secret; you recompute the signature and compare. If they match, the message is genuine and unmodified.

Why not just hash the key and message together?

Because naive constructions are vulnerable to length-extension attacks against Merkle-Damgård hashes such as SHA-256. HMAC’s nested inner and outer hashing with padded keys is specifically designed to prevent that.

Why does my signature not match?

Almost always the message bytes differ. Re-serialising JSON changes key order and whitespace, and a trailing newline is enough to break it. Always sign and verify the exact raw body, never a re-encoded version.

How should I compare signatures in code?

With a constant-time comparison function. A normal string comparison returns early on the first mismatched byte, which leaks timing information an attacker can use to forge a signature byte by byte.

Runs in your browser

This tool works with your network connection switched off. Values are produced by the browser Web Crypto API and never leave your device — no request is made, nothing is logged.

How the rest of the site handles data