Generate an HMAC Signature
Debug a webhook or an API signature: paste the payload and the shared secret, pick the algorithm and compare the result with the signature you received. Keys can be text, hex or Base64.
- Free
- Runs in your browser
- Webhook signature check
- No sign-up
How It Works
Sign or verify in three steps.
Paste the message
The exact bytes that were signed, such as the raw request body.
Enter the secret
As text, hex or Base64, and choose HMAC-SHA256 or another algorithm.
Compare
Paste the received signature to see whether it matches.
What is an HMAC?
An HMAC (hash-based message authentication code) combines a message with a secret key and hashes the result. Anyone with the same key can recompute it, and nobody without the key can produce a valid one, so it proves a message came from someone who knows the secret and was not changed. Services such as GitHub, Stripe and Shopify sign their webhooks this way, usually with HMAC-SHA256.
Most signature failures come from the message, not the key: the signature covers the raw body exactly as sent, so re-serialised JSON with different spacing will not match.
Text, hex or Base64 keys
Use the key in the form the service gives it to you.
Four algorithms
HMAC-SHA256, SHA-512, SHA-384 and SHA-1, from your browser's Web Crypto.
Hex or Base64 output
Stripe and GitHub use hex; Shopify and many others use Base64.
Signature check
A sha256= prefix, as in GitHub's header, is ignored when comparing hex.
Convert PDF Files and File Formats
Find the perfect online tool to combine PDF files, compress documents, and handle your daily workflow effortlessly.
PDF Tools
All your PDF needs in one place
- Merge PDF
- Organize PDF
- Split PDF
- Compress PDF
- Convert to Word
- Convert to Image
Image Tools
Edit and optimize your images
- Resize Image
- Compress Image
- Convert Format
- Crop Image
- Add Watermark
- Remove Background
Word Tools
Work with Word documents
- Convert to PDF
- Merge Documents
- Split Documents
- Compress File
- Edit Text
- Add Watermark
Excel Tools
Process Excel spreadsheets
- Convert to PDF
- Convert to CSV
- Merge Sheets
- Split Sheets
- Compress File
- Clean Data
Why Use This HMAC Generator
Debug signatures without writing code.
Verify received signatures
Paste the header value and see Match or No match.
Every key format
Text, hex and Base64 keys.
Secret stays local
The key is used in your browser and never sent anywhere.
Hex or Base64
Output in the format your service uses.
Frequently Asked Questions
Questions people ask about the HMAC Generator.
Usually the message is not byte-for-byte the same: the framework parsed and re-serialised the JSON, or whitespace changed. Sign the raw request body. Also check the key format (text versus Base64) and the algorithm.
Anyone can compute a hash of a message. An HMAC also needs the secret key, so only parties who share it can create or check it.
HMAC-SHA256, unless the service specifies another. HMAC-SHA1 is still secure as an HMAC but is being phased out.
Stripe signs the timestamp, a full stop and the body together (t.payload). Build that string in the Message box to reproduce its signature.
Related Text & Developer Tools
More small utilities that run in your browser.
Hash Generator
Make MD5, SHA-1, SHA-256 and SHA-512 hashes of text.
SHA-256 Hash Generator
Get the SHA-256 hash of text or a file and verify a download.
JWT Generator
Create and sign HS256, HS384 or HS512 test tokens.
Base64 Encode & Decode
Encode text to Base64 or decode it back.
AES Encrypt & Decrypt
Encrypt text with a password using AES-256-GCM.