HMAC Generator
Generate keyed HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures locally in your browser. For webhooks, APIs and signed messages.
What does this tool do?
HMAC (Hash-based Message Authentication Code) is a keyed hash: it turns a message into a fixed-size signature using a secret key. Unlike a plain hash, the signature can only be reproduced by someone who knows the secret, so it proves both integrity and authenticity. This tool computes HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512 locally in your browser.
When to use HMAC
- Webhook signatures. Providers such as GitHub and Stripe sign webhook payloads with HMAC so you can verify the request really came from them.
- API authentication. Signed request schemes use HMAC to authenticate without sending the secret itself.
- Signed tokens and cookies. HMAC produces tamper-evident values: any change to the message breaks the signature.
How to verify a webhook signature
- Paste the raw request body into Message / payload.
- Paste the shared secret into Secret key.
- Select the algorithm the provider documents (usually SHA-256).
- Compare the result with the signature header. If they match, the payload is authentic.
HMAC vs a plain hash
A plain hash (see Hash Generator) proves nothing about who created the value — anyone can hash. HMAC requires the secret key, so a valid signature is evidence that the sender knows the secret.
Which algorithm should I use?
- SHA-256 is the modern default for webhooks and signed messages.
- SHA-384 and SHA-512 are stronger variants of the SHA-2 family.
- SHA-1 is considered weak — keep it only for legacy integrations.
Privacy
Everything runs locally in your browser. The secret key and the message are never uploaded.