HMAC Generator
Sign a message with a secret key, or check that a webhook really came from the service it claims. Enter the message and the key and get the HMAC with every SHA algorithm at once.
How to generate an HMAC
- 1Type or paste the message, or choose a file.
- 2Enter the secret key.
- 3Copy the HMAC for the algorithm you need, such as HMAC-SHA256.
Checking webhooks
Services like GitHub, Stripe and Shopify sign each webhook with an HMAC of the raw request body. Paste the body exactly as received, enter your webhook secret and compare the result with the signature header.
Keys and encodings
The key and the message are read as UTF-8 text. Some services show signatures in Base64 instead of hex; the bytes are the same, only written differently.
Why HMAC
Unlike a plain hash, an HMAC can only be produced by someone who knows the key, so it proves both that the message is intact and who sent it.
Frequently asked questions
- Is my secret key sent anywhere?
- No. The HMAC is computed in your browser with Web Crypto.
- Why doesn't my signature match?
- The message must be byte-for-byte identical: a reformatted JSON body, an extra line break or a different key gives a completely different HMAC.