Why HMAC Generator?
Every serious webhook integration eventually hits the signature check: compute the HMAC of the payload with the shared secret and compare it to the header. This tool does that in the browser, so you can debug provider signatures, generate test fixtures, and confirm your handler logic without spinning up a server.
- Providers like Stripe and GitHub sign payloads with HMAC-SHA256 - paste the exact payload bytes (not the pretty-printed version) or the signature will not match.
- When verifying, match the encoding the provider uses; most use hex, but base64 is common too.
- Your secret key never leaves the page - everything runs locally with the Web Crypto API.
What is HMAC Generator?
HMAC Generator creates keyed-hash message authentication codes (HMAC) from a message and a secret key, using SHA-256, SHA-384, or SHA-512, with output in hex or base64. HMAC is the standard way providers like Stripe, GitHub, and Twilio sign webhook payloads and API requests, so you can verify that a message really came from them and was not tampered with in transit. Everything runs in the browser via the Web Crypto API — your secret never leaves the page.
Common Use Cases
Webhook Signature Verification
Recompute the HMAC of a webhook payload and compare it to the signature header to confirm authenticity.
API Request Signing
Generate HMAC signatures for API requests that require shared-secret authentication.
Testing Webhook Handlers
Create fixture signatures in tests so your handler logic can be verified without a live provider.
Learning HMAC
See how message, key, and algorithm changes alter the signature before implementing it in code.
How to Use This Tool
- Switch to Generate or Verify mode
- Enter the message or payload and the shared secret key
- Pick the hash algorithm (SHA-256, SHA-384, SHA-512) and output encoding
- Copy the signature, or paste an expected HMAC to verify it
Related Tools
Learn More
- RFC 2104 — HMAC specification The formal definition of the HMAC construction.
- Stripe webhook signature guide A real-world example of HMAC-SHA256 webhook verification.