HMAC Generator
Sign data with a secret key using HMAC-SHA1/256/384/512. Generate signatures for webhooks and APIs, or verify a signature against a payload.
📌 Usage notes & common pitfalls
- Webhook signatures (e.g. Stripe): algorithm
SHA-256, message = raw request body, key = signing secret, output = hex. - GitHub webhooks:
sha256=prefix on the signature. Strip the prefix before comparing. - Binary payloads: check Input is hex and paste the raw hex of the bytes.
- Key encoding: the key is treated as UTF-8 text. If you have a hex key, convert it first.
- Comparison in Verify mode is constant-time, but timing-safe at rest — this is a debugging aid, not for production verification.
About this tool
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to produce a signature that proves a message has not been tampered with and comes from someone who knows the key. Unlike a plain hash, an attacker cannot forge a valid HMAC without the secret. This tool signs data with HMAC-SHA1, SHA-256, SHA-384, or SHA-512, and can verify an existing signature against a payload.
Example: with key mysecret, algorithm SHA-256, and message {"event":"ping"}, the output is a 64-character hex signature. The recipient, who also knows mysecret, recomputes the HMAC over the same message and compares — if the signatures match, the message is authentic.
Webhook signing is the most common use case. Stripe, GitHub, Slack, and most APIs sign their webhook payloads with HMAC so you can verify that an incoming request really came from them. Use the Verify tab, paste the raw request body as the message, your webhook secret as the key, and the signature from the request header.
FAQ
What is the difference between a hash and an HMAC? ›
A hash only depends on the input data, so anyone can compute it. An HMAC also requires a secret key, so only someone who knows the key can produce or verify the signature. This makes HMAC suitable for authenticating messages between two parties who share a secret.
Which algorithm should I use? ›
SHA-256 is the standard choice and what most webhook providers use (Stripe, GitHub, Slack). SHA-1 is supported for older systems. SHA-384 and SHA-512 produce longer signatures and are used when a higher security margin is required.
How do I verify a GitHub webhook signature? ›
GitHub sends signatures prefixed with "sha256=". The Verify tab automatically strips the sha256= prefix, so you can paste the full header value as-is. Use the webhook secret configured in your GitHub repo settings as the key, and the raw request body as the message.
Why is the message read as text by default? ›
Most webhook payloads are JSON text, so UTF-8 text is the default. If you have raw binary data, check "Input is hex" and paste the hex-encoded bytes of the payload — the tool will decode them before signing.