HMAC Generator
Enter a message and a secret key to get the HMAC in hexadecimal and Base64. Useful for verifying webhook signatures and API requests.
HMAC (hex)
Enter a message and a key.
HMAC (Base64)
About this tool
A hash-based message authentication code combines a secret key with a message so that only someone who knows the key can produce or verify the tag. Webhooks from Stripe, GitHub, Shopify and many others sign their payloads with HMAC-SHA256; API schemes such as AWS Signature v4 chain several HMACs. Being able to compute one by hand is the quickest way to debug a signature mismatch.
The tool uses the browser's Web Crypto API, so the result is identical to OpenSSL, Python's hmac module or Node's crypto. The key and message are treated as UTF-8 text. Nothing leaves your device.
Frequently asked questions
- My HMAC does not match the one from the server. Why?
- Usually the message differs by a trailing newline, or the key is Base64/hex that should be decoded first. Compare the raw bytes on both sides.
- Which algorithm should I use?
- HMAC-SHA256 is the standard choice. SHA-1 is only for compatibility with older systems.
- Is a hash the same as an HMAC?
- No. A hash has no key; anyone can recompute it. An HMAC needs the secret key.