HMAC Generator is a free tool that creates HMAC signatures (HMAC-SHA256, SHA-512, SHA-384 or SHA-1) from a message and a secret key, and checks whether a signature you received matches. It is designed for testing and debugging webhook and API signatures. The calculation uses your browser’s built-in cryptography, so your key and message never leave your device.
How to generate an HMAC
- Enter the secret key, and choose whether it is plain text, hex or Base64.
- Choose the algorithm, usually SHA-256.
- Paste the exact message, such as the raw webhook body.
- Copy the signature, or paste a received signature to compare them.
Verifying webhooks
Services such as Stripe, GitHub, Shopify and Slack sign each webhook with a shared secret and send the signature in a header. Your server recalculates the HMAC of the request body and rejects the request if it doesn’t match. When a signature fails, check that:
- you are signing the raw body, byte for byte, before any JSON parsing or reformatting;
- the key format is right (some secrets are Base64 or hex, some are used as plain text, including prefixes such as
whsec_); - you include anything else the service signs, such as a timestamp joined to the body;
- you compare in the right encoding: hex or Base64. A
sha256=prefix in the header is ignored here.
Comparing signatures safely
In your own code, compare signatures with a constant-time function (such as Node’scrypto.timingSafeEqual or Python’s hmac.compare_digest) rather than ==, so attackers can’t learn the correct signature one character at a time.
A plain hash without a key, such as a SHA-256 of some text, comes from theHash Generator. Many APIs send their signature as Base64 rather than hex;Base64 Decode shows the raw bytes if you need to compare formats. If the signature comes inside a login token, the JWT Decoder shows its parts.
Frequently asked questions
Is it safe to enter my secret key?
The signature is calculated in your browser with its built-in cryptography, and nothing is sent anywhere. Even so, prefer testing keys over production secrets when you can.
Why doesn’t my webhook signature match?
The message must be byte-for-byte identical to what the sender signed, which is usually the raw request body before any parsing or reformatting. Some services also sign a timestamp together with the body, so check their documentation for the exact format.
What is the difference between HMAC and a plain hash?
A plain hash can be calculated by anyone. An HMAC mixes in a secret key, so only someone who knows the key can produce a valid signature, which proves the message came from them and was not changed.
Last updated