HMAC Generator
Generate and verify HMAC-SHA256, SHA-384 and SHA-512 signatures from a message and a secret key — the standard way webhooks prove they are genuine.
About this signature
Signatures are computed in your browser using the native WebCrypto API. Neither the message nor the secret key is sent to any server.
What It Does
An HMAC is a signature: a short tag computed from a message and a secret key, which anyone holding the same key can recompute to check two things at once — that the message has not been altered, and that it came from someone who knows the secret. That is why it sits behind almost every webhook you will ever integrate. When Stripe or GitHub posts an event to your server, they include an HMAC of the request body in a header, and your job is to compute the same value and compare. This tool does both halves of that. Give it a message and a key and it produces the signature; paste in a signature you received and it tells you whether it is valid. The distinction worth holding on to is that a plain hash proves a message has not changed, while an HMAC also proves who it came from.
When to Use It
- A webhook from a payment provider is being rejected by your signature check and you need to work out whether the mismatch is your secret, your algorithm or the exact bytes you are signing.
- You are implementing request signing for your own API and want to confirm your server code produces the same tag as a known-good reference before you ship it.
- A partner sent you an integration spec with a sample payload, a sample key and an expected signature, and you want to verify your understanding of it in seconds rather than in a test suite.
- You need a signed value in a URL — an unsubscribe link or a one-time download token — that your server can later verify was not tampered with.
Worked Examples
what do ya want for nothing?
Paired with the key "Jefe", this is test case 2 from RFC 4231, the specification that defines HMAC test vectors. The HMAC-SHA256 result should begin 5bdcc146 — a quick way to confirm any implementation is correct.
{"id":"evt_1P2x","type":"payment_intent.succeeded","amount":2400}
A webhook body of the shape providers actually send. Sign this with your endpoint secret and compare against the header you received. If it does not match, the usual culprit is that your framework re-serialised the JSON before you signed it.
user=42&expires=1793923200
A signed URL payload. The server appends the HMAC as a query parameter and can then verify on the way back in that neither the user id nor the expiry was edited by whoever holds the link.
Features
How to Use
1. Paste the message you want to sign — for a webhook, the exact raw request body. 2. Enter the shared secret key. 3. Choose the algorithm, or leave it on SHA-256, which is what most providers use. 4. The signature appears immediately; copy it with the button beside it. 5. To check a signature you received, paste it into the verification box and the tool will tell you whether it matches.
Common Mistakes
- Signing the parsed and re-serialised body instead of the raw one. Once a JSON parser has been through your payload, key order and whitespace can change, and the signature computed over it will never match the sender's. Capture the raw body before anything touches it.
- Comparing signatures with a plain equality operator. It returns early on the first mismatched character, and that timing difference is enough to let an attacker recover a valid signature. Use hash_equals, timingSafeEqual or compare_digest.
- Forgetting to strip the algorithm prefix. Several providers send the header as sha256=abc123… — compare against the part after the equals sign, not the whole string.
- Using a short or human-memorable signing key. HMAC's strength rests entirely on the key being unguessable, so a dictionary word undoes the whole construction. Generate at least 32 characters from a real random source.
- Assuming the signature keeps the payload private. It authenticates the message but does not conceal it — anyone who intercepts the request still reads the body. Use TLS for confidentiality.