Skip to content
koducathome

HMAC Generator

Generate HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512 signatures from a message and a secret key — to sign or check webhook and API requests.

How to use this tool

Steps for using the Hash Generator.

  1. HMAC is on. Enter the HMAC secret key — the shared secret from your webhook or API settings.
  2. Paste the exact message or request body (or choose File). HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512 are shown together.
  3. Choose hex or Base64 to match how your provider sends the signature.
  4. Paste the signature you received into Verify a checksum — a green match means the message is authentic and unchanged.

Example

The widely used example

Key: key · Message: The quick brown fox jumps over the lazy dog
The quick brown fox jumps over the lazy dog
HMAC-SHA256 (hex)
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Common use cases

  • Checking webhook signatures while building or debugging an integration.
  • Producing signatures for APIs that sign requests with HMAC-SHA256.
  • Reproducing the HMAC step of JWT HS256 signing.
  • Comparing your server's HMAC output with a known-good value.

How HMAC signs a message

An HMAC (hash-based message authentication code, RFC 2104) combines a secret key with a hash function. The result proves two things: the message hasn't changed, and it was produced by someone who knows the key. A plain hash proves only the first — anyone can recompute it.

Internally, HMAC hashes the message with the key mixed in, then hashes that result again with the key mixed in a second way. This construction is what makes it safe even with hashes that suffer from length-extension attacks.

Webhook providers and APIs use it to sign requests: they compute HMAC-SHA256 of the raw request body with your shared secret and send it in a header. You recompute it over the exact bytes received — not re-formatted JSON — and compare. Many providers also sign a timestamp to stop replays; check their docs for the exact string to sign.

This page computes HMAC with the browser's Web Crypto API (crypto.subtle.sign). The key and message stay in your browser, but treat production secrets with care: prefer a test secret when experimenting.

Limitations

  • HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512 only — HMAC-MD5 and HMAC-SHA1 aren't offered.
  • The key is used as UTF-8 text; keys given in hex or Base64 must be entered as their text form.
  • Signatures depend on the exact bytes: spacing, key order or a trailing newline change the result.

Frequently asked questions

What is the difference between a hash and an HMAC?

Anyone can compute a hash. An HMAC also needs the secret key, so a matching HMAC shows the message came from someone who has the key and wasn't modified.

Why doesn't my webhook signature match?

Usually the message isn't byte-for-byte identical — the body was re-serialised, whitespace changed, or the provider signs a timestamp plus the body. Also check hex vs Base64 and that you're using the right secret.

Is HMAC-SHA256 secure?

Yes, with a strong random key (at least 32 bytes for HMAC-SHA256). Compare signatures with a constant-time function in your server code.

Can HMAC be reversed to get the key?

No. With a long random key it is not practical to recover the key or forge a signature from examples.