🔑

HMAC Generator

Generate and verify HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 signatures in hex or base64.

HMAC generatorHMAC SHA256webhook signature generatorHMAC verifierHMAC calculator
Input
0 characters0 bytes
HMAC Configuration

Everything runs in your browser via the Web Crypto API — the message and secret never leave your machine.

Why HMAC Generator?

Every serious webhook integration eventually hits the signature check: compute the HMAC of the payload with the shared secret and compare it to the header. This tool does that in the browser, so you can debug provider signatures, generate test fixtures, and confirm your handler logic without spinning up a server.

  • Providers like Stripe and GitHub sign payloads with HMAC-SHA256 - paste the exact payload bytes (not the pretty-printed version) or the signature will not match.
  • When verifying, match the encoding the provider uses; most use hex, but base64 is common too.
  • Your secret key never leaves the page - everything runs locally with the Web Crypto API.

What is HMAC Generator?

HMAC Generator creates keyed-hash message authentication codes (HMAC) from a message and a secret key, using SHA-256, SHA-384, or SHA-512, with output in hex or base64. HMAC is the standard way providers like Stripe, GitHub, and Twilio sign webhook payloads and API requests, so you can verify that a message really came from them and was not tampered with in transit. Everything runs in the browser via the Web Crypto API — your secret never leaves the page.

Common Use Cases

Webhook Signature Verification

Recompute the HMAC of a webhook payload and compare it to the signature header to confirm authenticity.

API Request Signing

Generate HMAC signatures for API requests that require shared-secret authentication.

Testing Webhook Handlers

Create fixture signatures in tests so your handler logic can be verified without a live provider.

Learning HMAC

See how message, key, and algorithm changes alter the signature before implementing it in code.

How to Use This Tool

  1. Switch to Generate or Verify mode
  2. Enter the message or payload and the shared secret key
  3. Pick the hash algorithm (SHA-256, SHA-384, SHA-512) and output encoding
  4. Copy the signature, or paste an expected HMAC to verify it

Related Tools

Learn More