HMAC Generator
Generate a keyed-hash message authentication code (HMAC) from any message and secret key.
100% in-browser · no data sent
Choose SHA-1, SHA-256, SHA-384, or SHA-512, output the digest as hex or base64, and paste an expected signature to verify it matches. Everything runs in your browser — your secret key is never sent anywhere.
Embed This Tool
Add this tool to your website with customizable styling
How to Use
Enter your message
Paste the exact payload you want to sign — for a webhook, this is the raw request body, byte for byte. Any extra whitespace changes the signature.
Add your secret key
Type or paste the shared secret. It stays hidden by default; use the show button to check it. The key never leaves your browser.
Pick the algorithm and format
Choose the hash algorithm (SHA-256 is the most common) and whether the digest should be hex or base64. The signature updates instantly as you change either.
Copy or verify the signature
Copy the digest with one click, or open the verify panel and paste an expected signature to check whether the two match.
Frequently Asked Questions
What is an HMAC and how is it different from a plain hash?
An HMAC (hash-based message authentication code) combines a message with a secret key to produce a digest. A plain hash like SHA-256 only proves the message has not changed — anyone can recompute it. An HMAC also proves the sender knew the secret key, so it authenticates the message as well as protecting its integrity. That is why webhooks and signed APIs use HMAC rather than a bare hash.
Which algorithm should I choose?
HMAC-SHA256 is the default for almost every modern API and webhook (Stripe, GitHub, Shopify, Slack and AWS all use it). SHA-384 and SHA-512 give a longer digest if you need extra margin. HMAC-SHA1 is only there for legacy systems — SHA-1 collisions do not break HMAC-SHA1 outright, but do not choose it for anything new.
How do I verify a webhook signature with this tool?
Copy the raw request body into the message field, paste your webhook signing secret into the key field, and select the algorithm the provider documents (usually SHA-256). Then open the verify panel and paste the signature from the request header. If it says the signature is valid, the payload really came from the provider and was not modified. Note that some providers sign a prefixed string (for example a timestamp plus a dot plus the body) rather than the body alone — check their docs.
Is it safe to paste my secret key here?
The HMAC is computed entirely in your browser with the built-in Web Crypto API. Your message and key are never uploaded, logged, or sent to a server — the page works offline once loaded. That said, treat any production secret with care: prefer a test key when you can, and never paste a live secret into a tool you have not verified, on this site or any other.