HMAC generator
Create and check HMAC signatures with SHA-256, SHA-384, SHA-512 or SHA-1, with the key as text, hex or Base64.
How to use
Type or paste the message, enter the secret key and choose the algorithm; the signature appears as you type, in hexadecimal and in Base64, each with its own Copy button. It is computed with the browser’s Web Crypto API, and nothing is sent anywhere.
HMAC, defined in RFC 2104, combines a secret key with a hash function. Anyone can compute a plain SHA-256 of a message, but only someone who holds the key can compute its HMAC, so a matching signature shows that the message came from a key holder and was not changed on the way. The signature is as long as the hash: 32 bytes for SHA-256, 48 for SHA-384, 64 for SHA-512 and 20 for SHA-1.
The key can be typed as text, which is used as UTF-8 bytes, or given in hexadecimal or Base64 when a service shows it that way: the same characters read in another format are a different key. The message is signed exactly as typed, so one changed space, line break or character changes the whole signature.
To check a webhook, paste the raw request body as the message, the endpoint’s secret as the key and the received signature into Signature to check. GitHub, for example, sends an X-Hub-Signature-256 header with sha256= followed by the hex HMAC-SHA256 of the body; the prefix is ignored. SHA-1 is offered only for older systems: GitHub still sends an HMAC-SHA1 header, for legacy purposes only.
Example
Checks GitHub’s documented webhook example: the secret “It's a Secret to Everybody” and the payload “Hello, World!” give the sha256= signature GitHub publishes, so it matches.
Jefe · what do ya want for nothing?HMAC-SHA256 5bdcc146…64ec3843: the test vector in RFC 4231.It's a Secret to Everybody · Hello, World!GitHub’s documented example: sha256=757107ea…8b043e17.0b0b…0b (hex, 20 bytes) · Hi ThereHMAC-SHA256 b0344c61…2e32cff7: RFC 4231 test case 1, with the key in hex.abcdAs text, 4 bytes; as hex, 2 bytes (ab cd): two different keys and two different signatures.
Frequently asked questions
Is HMAC the same as a hash?
No. A hash such as SHA-256 needs no key, so anyone can recompute it after changing the message. An HMAC needs the secret key, so only someone who has it can produce a valid signature.
Why does my webhook signature not match?
Usually the message is not byte for byte what was signed: a framework parsed and re-serialised the JSON, trimmed whitespace or changed the encoding. Sign the raw body exactly as received, and check that the secret belongs to that endpoint and that the key format is right.
Should I use SHA-1?
Only to talk to a system that still requires it. New signatures use SHA-256 or longer hashes, and GitHub, for example, keeps its SHA-1 signature header for legacy purposes only.
Is my key sent anywhere?
No. The signature is computed in your browser with the Web Crypto API. Even so, avoid pasting live production secrets into any website you do not control: a test secret is enough to see how signatures work.