🔏 HMAC Generator
Sign a message with a secret key to get its HMAC — the keyed hash used to verify webhooks and API requests, computed locally.
HMAC needs both a message and a secret key — unlike a plain hash. It proves the message came from someone who knows the key. A common use is verifying webhook signatures: services like Stripe and GitHub sign each payload with your secret so you can confirm it is genuine and untampered.
Everything runs locally in your browser. Your secret and message are never uploaded, and the tool works fully offline.
How the hmac generator works
HMAC combines a message with a secret key and a hash function (SHA-1, SHA-256, SHA-384 or SHA-512) to produce a fixed-length signature that only someone with the key can reproduce. The tool computes it with the browser's Web Crypto API and shows the result as hexadecimal or base64. Unlike a plain hash, HMAC needs a key — it proves the message came from someone who holds the secret and wasn't altered in transit.
This is exactly how webhook providers sign their payloads: Stripe, GitHub and others HMAC the request body with a secret you share, and you recompute the HMAC on your side to confirm the request is genuine and untampered. HMAC is authentication, not encryption — it doesn't hide the message, it proves its origin and integrity. Everything runs on your device, so the secret is never transmitted.
Frequently asked questions
What is an HMAC?
A Hash-based Message Authentication Code: a keyed hash of a message that proves it came from someone who knows the secret key and hasn't been changed. It uses a standard hash (SHA-256 and friends) combined with the key.
How is HMAC different from a normal hash?
A plain hash (like SHA-256) needs only the message, so anyone can compute it. HMAC also requires a secret key, so only holders of the key can produce or verify the value — which is what makes it useful for authentication.
How do I verify a webhook signature?
Take the raw request body and your shared signing secret, compute the HMAC with the algorithm the provider specifies (usually SHA-256), and compare it to the signature header they sent. A match means the request is genuine.
Should the output be hex or base64?
Whichever your system expects — both represent the same bytes. Many APIs use hex for signatures; some use base64. The tool gives you either.
Is my secret key uploaded?
No — the HMAC is computed with Web Crypto in your browser. The message and key never leave your device, and it works offline.