Advertisement
Guide
About the HMAC Generator
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature that proves two things at once: that a message hasn't been altered (integrity) and that it came from someone who knows the shared secret (authenticity). It's the mechanism behind webhook signatures, API request signing, and the HS256 family of JWT signatures.
This tool computes an HMAC over your message using a secret key and your chosen hash algorithm, and can also verify an existing HMAC. It uses the browser's native Web Crypto API, so signing is fast and your keys never leave the page.
HMAC vs. a plain hash
A plain hash (like SHA-256) only proves integrity — but anyone can recompute it, so it doesn't prove whoproduced the message. Because HMAC mixes in a secret key, only parties holding that key can generate or verify a valid code. That's why webhook providers sign payloads with HMAC: you recompute the HMAC on your end with the shared secret and compare, confirming the request genuinely came from them.
Verify in constant time
When you check an incoming HMAC on a server, compare it using a constant-time comparison rather than a normal string equality check. A naive comparison can leak timing information that helps an attacker guess the signature byte by byte. This tool verifies locally for convenience; in production code, use your platform's timing-safe compare function.
How to use it
- 1Enter the message you want to sign.
- 2Enter the shared secret key.
- 3Pick the hash algorithm (SHA-256 is the common default).
- 4Copy the resulting HMAC, or paste an existing one to verify it matches.
Frequently asked questions
What is HMAC used for?
Verifying webhook payloads, signing API requests, and generating HS256/384/512 JWT signatures. Anywhere you need to confirm a message is unchanged and came from a party holding a shared secret.
What is the difference between HMAC and a digital signature?
HMAC uses one shared symmetric secret, so anyone who can verify can also sign. A digital signature (like RSA or ECDSA) uses a private key to sign and a public key to verify, so verifiers cannot forge signatures.
Which hash should I use with HMAC?
HMAC-SHA256 is the standard default and is widely supported. SHA-384 and SHA-512 offer longer output; choose whichever your integration specifies.
Is HMAC-SHA1 secure?
HMAC remains secure even when built on SHA-1 for authentication purposes, but SHA-256 is the recommended modern default for new systems.
How do I verify a GitHub or Stripe webhook?
Open “Webhook signatures”, pick the provider, paste the signing secret and the raw request body (and the timestamp, for Stripe and Slack), then paste the signature header you received. The tool rebuilds the signed string the way that provider does and tells you whether it matches.
Why does my webhook signature not match?
Almost always because the body is not byte-for-byte what was sent: frameworks often parse and re-serialise JSON, changing spacing or key order. Sign the raw body. Other causes are the wrong secret (test vs live), or for Standard Webhooks, using the whsec_ string as text instead of Base64-decoding it.
My key is in hex or Base64 — does that matter?
Yes. HMAC works on bytes, and the text "6b6579" is not the same key as the bytes 6b 65 79. Set the key encoding to Hex or Base64 when your provider hands you an encoded key.
Does my secret key leave my browser?
No. The HMAC is computed locally with the Web Crypto API — the message and key are never transmitted, saved, or put in a share link.