Security

HMAC Generator — Keyed Message Authentication

Signs a message with a shared secret using HMAC-SHA, so you can reproduce the signature a webhook sender computed.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the exact message body that was signed — byte for byte, before any parsing or re-formatting.
  2. Type the shared secret into the key field. It stays in this page.
  3. Choose the algorithm and output encoding the sender documents, usually SHA-256 in hex.
  4. Select Sign and compare with the signature header. If it does not match, suspect the message bytes before you suspect the key.

What hmac generator does

An HMAC is a hash with a key mixed in. Anyone can compute the SHA-256 of a message, so a bare hash proves nothing about who produced it; an HMAC can only be produced by someone holding the secret, which is why almost every webhook signs its payload this way. Verifying one means computing the HMAC yourself and checking it matches the header you were sent.

That is the job this page does, and the reason it is worth doing here rather than on a server you do not control: the secret is typed into a form on this page, used by your browser’s own Web Crypto implementation, and never transmitted. If a test signature will not match, the cause is almost always the exact bytes being signed — a trailing newline, a re-serialised JSON body, or the raw body having been parsed and re-encoded before you got to it.

Frequently asked questions

The secret is used by Web Crypto inside your browser and is never transmitted — the page has no server to transmit to. That said, it is a secret displayed on a screen: use a test key where you can, and if you must use a production one, do it on a machine only you use.

Almost always the message bytes rather than the key. Signatures are computed over the exact raw body, so a framework that parsed the JSON and re-serialised it before you saw it produces different bytes. Check for a trailing newline too, and for a signing scheme that prefixes a timestamp to the body.

HMAC hashes twice with two derived keys, in a specific construction. Naively appending a key to a message and hashing it is vulnerable to length-extension attacks against the SHA-2 family, which HMAC is designed to prevent. Use the standard construction; do not invent one.