HMAC Generator
Generate and verify HMAC signatures for text or files — useful for debugging webhook signatures. Runs entirely in your browser.
Signature
Enter a secret key and a message to generate the signature.
Note:
- Everything runs locally in your browser — your secret is never sent anywhere
- Sign the exact raw request body: re-serialised JSON often differs by whitespace and will not match
- A leading
sha256=prefix is ignored when comparing signatures
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The HMAC Generator computes a keyed hash message authentication code over any text or file using HMAC-SHA-256, SHA-1, SHA-384, or SHA-512. Unlike a plain checksum, an HMAC mixes a shared secret into the hash, so it proves both that a message is unmodified and that it came from someone holding the key.
Its most common use is debugging webhook signatures. Providers such as GitHub, Stripe, Shopify, and Slack sign each request body and send the result in a header — paste the raw body and your signing secret here, and compare against that header to find out why verification is failing. Because secrets are handed out in different formats, you can read the key as UTF-8 text, hex, or Base64, and emit the signature as hex or Base64. A leading sha256= prefix is ignored when comparing. Every operation uses the browser's Web Crypto API, so your secret never leaves your machine.
FAQ
An HMAC proves a message came from someone holding a shared secret and wasn't altered in transit. It's how webhook providers like GitHub, Stripe, and Slack sign their request payloads.
Almost always because the message isn't byte-identical. Sign the exact raw request body — re-serialised JSON differs by whitespace and key order. Also check whether the provider expects hex or Base64, and whether the secret is raw text, hex, or Base64.
Some providers send signatures as "sha256=<value>". This tool ignores that prefix when comparing, so you can paste the header value straight from your logs.
A plain hash can be recomputed by anyone. HMAC mixes in a secret key, so only parties who know the secret can produce or verify the signature. Use the Checksum Calculator for unkeyed hashes.
HMAC-SHA-256 is the modern default and what most webhook providers use. HMAC-SHA-1 appears in older APIs such as AWS Signature v2 and OAuth 1.0a.
No. Signing happens locally via the browser's Web Crypto API — your secret and message never leave your device and are never logged.