HMAC Generator
Generate an HMAC signature for a message and secret key — or check that a webhook signature from Stripe, GitHub, Shopify or your own API is correct.
Result
Enter a message and a secret key.
How to use this tool
- Paste the exact message (for webhooks, the raw request body) and the secret key.
- Choose the key format, algorithm and output format (hex or Base64).
- To verify a signature, paste it into Compare with signature. A sha256= prefix is ignored.
How it works
HMAC(key, message) = hash((key ⊕ opad) ‖ hash((key ⊕ ipad) ‖ message)), as defined in RFC 2104. SHA-family HMACs use your browser’s built-in Web Crypto; HMAC-MD5 uses this site’s MD5 implementation. The results match the published RFC 2202 and RFC 4231 test vectors.
Example
RFC 4231 test case 2
Key Jefe, message what do ya want for nothing?, HMAC-SHA256 = 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
Privacy and limitations
- Everything runs in your browser; nothing you paste is uploaded or stored. Do not paste production secrets into any website you do not trust; this tool is open about running locally, but your browser extensions can still see the page.
- A signature only matches if the message is byte-for-byte identical, including whitespace and line endings.
Frequently asked questions
Why does my webhook signature not match?
Usually because the body was re-formatted (for example parsed and re-serialised as JSON). Sign the raw body exactly as received, and check whether the provider expects hex or Base64.
Is HMAC encryption?
No. HMAC proves a message came from someone with the key and was not changed, but the message itself is not hidden.