About the HMAC Generator
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to prove both that a message hasn't been tampered with and that it was created by someone who knows the secret — the basis for webhook signature verification, API request signing, and many token schemes.
This tool computes an HMAC for a message and secret key using MD5, SHA-1, SHA-256, or SHA-512 as the underlying hash function.
How it works
- Enter the message you want to sign or authenticate.
- Enter the shared secret key (this must match exactly what the other party will use to verify).
- Choose the hash algorithm and click Generate to compute the HMAC.
Common use cases
- Verifying a webhook signature: Recomputing the HMAC of a webhook payload with your endpoint's signing secret to confirm it matches the signature header sent by the provider (like Stripe or GitHub).
- Signing API requests: Generating the HMAC signature required by an API that authenticates requests using a shared-secret signing scheme.
- Understanding a signing library: Manually reproducing what a signing library does under the hood, to debug a mismatch between expected and actual signatures.
Frequently asked questions
What's the difference between a hash and an HMAC?
A plain hash (like SHA-256 alone) only detects whether data changed; anyone can compute it, so it proves nothing about origin. An HMAC adds a secret key into the computation, so only someone who knows the secret can produce a matching HMAC — proving both integrity and authenticity.
Which algorithm should I use — SHA-256 or SHA-512?
Use whatever the system you're integrating with specifies — most modern APIs and webhook providers use HMAC-SHA256, but always match the exact algorithm the other party expects, since a mismatched algorithm produces a completely different, non-matching signature.
Why doesn't my computed HMAC match the one from an API?
The most common causes are: the message wasn't captured exactly as sent (e.g. extra whitespace, different line endings, or a re-serialized JSON payload with different key ordering), or the wrong secret or algorithm was used — HMACs are extremely sensitive to any byte-level difference in the input.
Is it safe to test real API secrets in this tool?
The computation happens entirely in your browser and nothing is transmitted, but as a general precaution it's safer to test with a non-production or rotated secret whenever possible.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.