About the HMAC Generator
An HMAC (hash-based message authentication code) combines a message with a secret key to produce a code that proves the message came from someone who knows the key and was not altered. It is how API requests are signed (AWS, Stripe webhooks), how JWTs with HS256 are protected, and how many systems verify integrity and authenticity together. This tool computes an HMAC from your message and a secret key, with SHA-256, SHA-1, SHA-512, MD5 and SHA-3 options.
Unlike a plain hash, an HMAC cannot be recomputed by anyone who does not have the key, which is what makes it useful for authentication. Choose the algorithm the receiving system specifies; SHA-256 is by far the most common. Output is hex or Base64.
Everything runs in your browser, so your secret key is never transmitted. Still, treat production secrets carefully and prefer test keys when experimenting. To verify a webhook, compute the HMAC of the payload with the shared secret and compare it to the signature header.
How to use
- Paste the message on the left.
- Enter the secret key and choose the hash algorithm.
- Copy the HMAC and compare it to the expected signature.
Common questions
- What is the difference between a hash and an HMAC?
- A hash needs no key and anyone can compute it. An HMAC mixes in a secret key, so only someone with the key can produce or verify it.
- Which algorithm should I use?
- SHA-256 (HMAC-SHA256) is the standard for most APIs and webhooks. Match whatever the service documents.
- Is my key sent anywhere?
- No. The HMAC is computed in your browser and the key never leaves it.
- How do I verify a Stripe or GitHub webhook?
- Compute the HMAC-SHA256 of the raw request body with the webhook secret and compare it, case-insensitively, to the signature header.