HMAC Generator (SHA-256/SHA-512)
Computes an HMAC signature from a message and a secret key, which is useful for verifying webhook signatures and debugging API authentication. Everything runs in your browser, and your key and message are never sent to a server. For a hash without a key, use the Hash Generator.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- Even one byte of difference in the message, including line breaks and spaces, gives a different signature. For webhooks, paste the raw received body exactly as is (do not re-format the JSON).
- HMAC-SHA1 has not been broken as an HMAC, but pick SHA-256 or stronger for anything new.
- Prefer a test key over a production secret. Nothing you type is stored or sent, but be careful when sharing your screen.
Glossary
HMAC
A construction that combines a secret key with a hash function to detect tampering and confirm the sender. Only someone holding the same key can produce the same signature.
Webhook signature
Services such as GitHub and Stripe attach an HMAC of the request body in a header to prove a notification is genuine. The receiver recomputes it with the same key and checks that it matches.
Base64URL
A Base64 variant that replaces "+" and "/" with "-" and "_" and drops the trailing "=". It is used in URLs and in the signature part of a JWT.
FAQ
Why does my webhook signature not match?
The most common cause is a message that differs by even one byte from the raw body you received. Re-formatting JSON, converting line endings, or adding a trailing newline changes the result. Also check whether the key is hex or text, and whether the signature is Base64 or hex.
Can I compute an HMAC with an empty key?
Yes. In the HMAC definition an empty key is treated the same as a key padded with zeros to the block size, so it works. You should not use an empty key in practice, though.
How is HMAC different from a plain hash like SHA-256?
Anyone can compute a plain hash, but only someone who knows the secret key can produce a valid HMAC. That makes it useful for confirming the sender as well as detecting tampering.
Is HMAC-MD5 supported?
No. Only SHA-1, SHA-256, SHA-384, and SHA-512 are available, which are the algorithms the browser Web Crypto API supports.
Share this page