📖 What is HMAC Generator?
HMAC (Hash-based Message Authentication Code) combines a secret key with a message to produce a signature that verifies both authenticity and integrity. This tool generates HMAC signatures using SHA-256, SHA-512, SHA-1 or MD5. Use it to test webhook signature verification (Stripe, GitHub, Slack), debug API authentication, or learn how HMAC works. Everything runs in your browser — your secret key is never transmitted.
💡 Example
Input
Message: Hello World
Key: my-secret-key
Algorithm: SHA-256
Output
HMAC-SHA256: a4331fa0b49bbd74c0bf35fa990ed0e...
🛠️ Common Use Cases
- Testing webhook signature verification (Stripe, GitHub, Slack, Twilio)
- Debugging HMAC-based API authentication
- Generating signatures for AWS Signature V4 requests
- Verifying JWT signatures manually
- Learning how HMAC authentication works
📝 HMAC Algorithms
HMAC-SHA256 — most common for modern APIs and webhooks (recommended)HMAC-SHA512 — longer hash, higher security marginHMAC-SHA1 — legacy, still used by some APIs (GitHub webhooks)HMAC-MD5 — deprecated for security, but still seen in legacy systems
Always use SHA-256 or SHA-512 for new implementations.
⚠️ Common Mistakes
- Wrong encoding — make sure the message and key use the same encoding (usually UTF-8). A difference produces a different HMAC.
- Hex vs Base64 output — APIs expect HMAC in either hex or Base64. Check the documentation for the correct format.
- Timing attacks — in code, always use constant-time comparison for HMAC verification, never string equality.
❓ Frequently Asked Questions
How do I verify a Stripe webhook signature? ▾
Stripe sends a signature in the Stripe-Signature header. Compute HMAC-SHA256 of the raw request body using your webhook secret, and compare with the signature in the header.
What is the difference between HMAC and a regular hash? ▾
A regular hash (SHA-256 of message) can be computed by anyone. HMAC requires a secret key, so only parties with the key can generate or verify the signature.
Which algorithm should I use? ▾
SHA-256 is the standard choice for new implementations. Use SHA-512 for additional security margin. Avoid MD5 and SHA-1 for new projects.
Is my data private? ▾
Yes — all processing runs entirely in your browser. Your data is never sent to any server.
Is this tool free? ▾
Completely free — no login, no usage limits, works offline once loaded.
Yes — completely free, no login required, no usage limits.
Is my data private? ▾
Yes — all processing runs in your browser. Your data is never sent to any server.
Does it work offline? ▾
Yes — once the page is loaded, the tool works without an internet connection.