HMAC Generator

Compute a keyed hash (HMAC) the same way webhook providers and APIs sign their requests. Enter the message and secret, pick SHA-256, SHA-384 or SHA-512, and get the signature in hex, Base64 and Base64URL. Paste the signature you received to confirm it matches.

Encoding & Security Runs in your browser

Generate an HMAC

JavaScript is required. This tool runs in your browser, so please enable JavaScript to use it. The instructions below are still available.

MessageSigned as UTF-8 bytes. A trailing newline changes the result.

Secret key

Key format

Algorithm

Expected signature (optional)

How to Use the HMAC Generator

Type or paste the exact message body.
Enter the secret key and say whether it is text, hex or Base64.
Choose the algorithm and optionally paste the expected signature.
Press Generate and copy the format you need.

About This Tool

Developers verifying webhook signatures from payment or chat platforms, engineers signing API requests and students checking RFC 4231 examples.

Input: Message + secret key · Output: Hex / Base64 / Base64URL.

Features and Limitations

Features

Uses the browser's Web Crypto API.
Keys as text, hex or Base64/Base64URL.
Output in hex, Base64 and Base64URL at once.
Signature check in any of those formats.

Limitations

The message is treated as UTF-8 text; binary payloads cannot be pasted.
Many webhook schemes sign a timestamp plus the body; you need to build that exact string yourself.
Requires a secure (https) page, as Web Crypto does.
Results are computed in your browser; nothing you enter is sent to a server.

Example

RFC 4231 test case 2: key Jefe and message what do ya want for nothing? give HMAC-SHA256 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.

Frequently Asked Questions

Why doesn't my webhook signature match?

Common causes: the body was re-formatted (signatures cover the raw bytes), the secret is Base64 or hex rather than text, the provider signs a timestamp too, or the signature has a prefix such as sha256=.

What is the difference between a hash and an HMAC?

A hash can be computed by anyone. An HMAC also needs a secret key, so only someone with the key can create a valid signature.

How long should the key be?

At least as long as the hash output: 32 bytes for SHA-256, 48 for SHA-384 and 64 for SHA-512.

Is my secret sent anywhere?

No. Signing happens in your browser.