Generate HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512 using a UTF-8 or hex secret key, output as hex or Base64. Computed in your browser, so your key never leaves it.
Updated
/ 5 - Be the first to rate this tool Thanks for rating!
Verification failed - please try again.
Quick check
Please verify you're not a robot to submit your rating.
Give feedback
Tell us what you think about HMAC Generator.
- Computed in your browser with Web Crypto — your key is never sent to a server
- SHA-1, SHA-256, SHA-384 and SHA-512 with hex or Base64 output
- UTF-8 or hex secret keys, updated live as you type
How it works
-
1
Choose the algorithm, key encoding and output format.
-
2
Enter the secret key.
-
3
Paste the message exactly as it was signed.
-
4
Copy the HMAC and compare it with the expected value.
About the HMAC Generator
Webhook providers such as Stripe, GitHub and Shopify sign each request with an HMAC, a hash that mixes the message with a shared secret. To debug a failing signature check, you need to compute the same value yourself. This generator does that with SHA-1, SHA-256, SHA-384 or SHA-512, taking the key as text or hex and showing the result as hex or Base64.
What you can do
- Compute an HMAC with SHA-1, SHA-256, SHA-384 or SHA-512.
- Enter the secret as UTF-8 text or as hex bytes, chosen under Key encoding.
- Show the signature as lowercase hex or as Base64, to match what your provider sends.
- See the result update whenever the message, key or any setting changes.
When it works best
- Working out why your server rejects a webhook by comparing your HMAC with the signature header.
- Signing a test request for an API that uses HMAC authentication, such as some payment or exchange APIs.
- Checking that two services share the same secret without sending the secret itself.
Things to know
- The HMAC is calculated with the Web Crypto API in your browser. Even so, prefer test secrets over production ones in any web tool.
- The message must match the signed bytes exactly; a reformatted JSON body or missing newline gives a different result.
- MD5 is not offered, and hex keys must be whole pairs of 0-9 and a-f characters.
- For a plain hash without a key, use the Hash Generator. To make a signed token, use the JWT Encoder.
Frequently asked questions
SHA-1, SHA-256, SHA-384 and SHA-512. MD5 is not offered.
The message must match the signed bytes exactly; reformatted JSON or a missing newline changes the result.
Yes, set Key encoding to hex and enter whole pairs of 0-9 and a-f.
Prefer test secrets, even though the calculation runs locally with Web Crypto.