HMAC Generator (SHA-256, SHA-384, SHA-512, SHA-1)

How it works

Paste the message to sign into the left pane and type the key the service gave you into the Secret key field; the HMAC signature appears on the right as you type. If you are testing a payment provider's webhook, paste the request body exactly as received, without adding a single space: one extra line break is enough to change the whole signature. Put the signature the service sent in its header into Expected signature; the tool strips prefixes such as sha256=, works out whether the value is hex or Base64 and reports MATCH or NO MATCH on the result line. If your key is a string of random bytes delivered in hex, set Key format to Hex bytes; read as text, the same characters make a completely different key. Most services use SHA-256; if the documentation says HmacSHA512, choose SHA-512. The calculation runs in your browser's built-in crypto engine: neither the message nor the key leaves this page, and the key is never written to error logs.

This tool is also known as hmac generator, hmac sha256 generator, hmac sha256 online, verify webhook signature, hmac sha512.

What is HMAC?

HMAC (hash-based message authentication code) produces a fixed-length signature from a message and a secret key (RFC 2104). The key is mixed with two different padding values and run through the chosen hash function twice. The result shows both that the message has not changed and that it was produced by someone who knows the key. Webhooks, signed API requests and session cookies are protected this way.

What is Webhook signature?

A webhook signature is the HMAC value a service adds to a header when it sends you a notification. The service signs the body with a secret key it shares with you; you sign the same body with the same key and compare your result with the header. If the two match, the notification really came from that service. The header name differs between services, and the value often carries a sha256= prefix or comes as Base64.

What is the difference between HMAC and a digital signature?

With HMAC, the signer and the verifier share the same secret key, so either of them could have produced a signature; HMAC cannot prove to a third party who signed. A digital signature (RSA, ECDSA) uses two keys: only the owner can sign, and anyone can verify with the public key. HMAC is much faster and is enough when two systems trust each other, as with webhooks and APIs; contracts and software releases, where the signer must not be able to deny signing, need a digital signature.

Signature does not match? The four usual causes

HMAC reacts to every single byte of the message. The most common reason a webhook signature fails is that the body you sign is not the body that was signed: pretty-printing the JSON, reordering fields or adding a final line break all change the result. Always sign the raw body exactly as it arrived.

The other causes: reading the key in the wrong format (using a hex key as text), the wrong algorithm (SHA-1 versus SHA-256) and comparing different encodings (hex on one side, Base64 on the other). Some services sign a timestamp together with the body; in that case the signed string is something like "timestamp.body", so check the documentation.

• Body changed: spaces, line breaks, field order
• Key format: a hex key read as text
• Algorithm: SHA-1, SHA-256 and SHA-512 mixed up
• Output: hex compared with Base64, or a timestamp prepended to the signed string

Which algorithm should you choose?

Use whatever the other side signs with. The service documentation names it, and the signature length gives it away: in hex, 40 digits means SHA-1, 64 SHA-256, 96 SHA-384 and 128 SHA-512. If you are designing your own system, HMAC-SHA256 is enough and is the most widely supported option.

The known collision weakness of SHA-1 does not directly break HMAC, but SHA-1 is not used in new designs and is listed here only for compatibility with older systems. MD5-based HMAC is not offered: browsers' crypto engine does not support MD5, and this tool relies on that engine instead of a hand-written algorithm.

Frequently asked questions

How do I generate an HMAC SHA256?

Paste the message into the left pane and the secret key into Secret key, and leave the algorithm on SHA-256. The 64-digit hex signature appears on the right; switch Output format to get Base64. The calculation happens in your browser.

What is the difference between HMAC and a plain hash?

Anyone can compute a plain hash, so whoever changes the message can also produce the new hash. HMAC mixes a secret key into the calculation: without the key, a changed message cannot get a valid signature. That is how HMAC proves a message came from someone who knows the key and was not altered on the way.

Is it safe to type my secret key into this page?

The key stays in your browser: the tool code is not allowed to make network requests, and even if an error occurs the key is not included in the error log — it is replaced by [gizli]. Still, avoid using a production key on a shared computer; use a separate test key.

Why is there no result when the key is empty?

HMAC requires a key by definition, and the browser's crypto engine refuses an empty one. For a keyless checksum of a file, use the Hash Generator.