Log in Sign up free

HMAC Generator

Generate HMAC-SHA1, SHA256, SHA384 or SHA512 signatures in hex and Base64.

Runs instantly in your browser — results update as you type.

What is HMAC?

HMAC (hash-based message authentication code) combines a secret key with a message and a hash function such as SHA-256 to produce a signature. Anyone with the key can check that the message is authentic and unchanged.

Where HMAC is used

  • Webhook signatures (Stripe, GitHub, Shopify, Slack) — verify that a webhook really came from the provider.
  • API request signing (AWS Signature, many payment gateways).
  • Signed cookies and tokens (JWT HS256 is HMAC-SHA256).

How to verify a webhook

  1. Take the raw request body exactly as received.
  2. Compute HMAC-SHA256 with your webhook secret.
  3. Compare it with the signature header (hex or Base64) using a constant-time comparison.

This tool calculates HMACs with the browser's Web Crypto API, so your key stays on your device. For plain hashes without a key, use the MD5 & SHA Hash Generator.

Frequently asked questions

Hex or Base64?

They are the same signature in two encodings. Use the one your API or webhook provider expects.

Is HMAC encryption?

No. It proves authenticity and integrity; the message itself is not hidden.

Why does my HMAC not match?

The message must be byte-for-byte identical, including whitespace and line endings, and the key must be exact.