Cryptography & Security

HMAC Generator

Sign a message with a shared secret to verify authenticity — the same construction used by webhook signatures and API request signing.

Free & unlimitedRuns in your browserNo sign-up required

Message (Raw payload)

Secret Key

Hash Algorithm

HMAC (Hex encoded)

4a8dedbf0290366b36389bc94442e7a20048fbd3ed8e11c416e69fa094cc1175

HMAC (Base64 encoded)

So3tvwKQNms2OJvJRELnogBI+9PtjhHEFuafoJTMEXU=

Hash-based Message Authentication Code (HMAC)

APIs need a way to prove a request actually came from who it claims to be from, and that nobody altered it in transit. That's what HMAC is built for.

How HMAC works

An HMAC combines a message with a secret key, run through a hash function like SHA-256 or SHA-512, to produce a signature. Anyone with the same secret key can recompute that signature from the message and confirm it matches. Anyone without the key can't forge a valid signature, even if they know exactly which hash algorithm you're using, because the secret key is mixed into the computation in a specific, well-studied way that resists length-extension attacks.

Webhook security

This is the backbone of webhook security. When Stripe, GitHub, Shopify, or any major API sends you a webhook, they typically include an HMAC signature in the request headers. Your server recomputes the HMAC using the shared secret and the raw request body, then compares it to the signature header. If they match, the payload is authentic and untampered.

Algorithm choices

This generator supports SHA-256, SHA-512, SHA-1, and MD5 as the underlying hash function. SHA-256 is the standard choice for new implementations and what you'll see in most modern API documentation. SHA-1 and MD5 versions still show up in older systems and legacy integrations, so having them available matters when you're debugging a webhook handler.

Debugging tip

A quick debugging tip if your HMAC verification keeps failing in production: check whether you're hashing the raw request body or a re-serialized version of it. JSON re-serialization can reorder keys or change whitespace, which changes the byte string being hashed and produces a completely different signature even though the "data" looks identical. Paste the exact raw payload and secret here to confirm what the signature should actually be, then compare it against what your code produces.

Loading tool…

How it works

Three steps, no setup

Provide the message

Enter the payload you want to authenticate.

Add your secret key

This is the shared key both sides already know — it is never transmitted anywhere.

Read the signature

Compare the output against an incoming X-Signature header to validate a webhook.

Common questions

Frequently asked questions

What is HMAC used for?

Services like Stripe and GitHub sign webhook payloads with HMAC-SHA256 so the receiver can confirm the request really came from them and was not tampered with in transit.

Does changing one character change the signature?

Yes. HMAC is extremely sensitive to input — a single changed byte in the message produces a completely different signature.

Keep exploring

Related tools

View all tools

Cryptography & Security

APIs need a way to prove a request actually came from who it claims to be from, and that nobody altered it in transit. That's what HMAC is built for.

HMAC Generator

Hash-based Message Authentication Code (HMAC)

How HMAC works

Webhook security

Algorithm choices

Debugging tip

Three steps, no setup

Provide the message

Add your secret key

Read the signature

Frequently asked questions

Related tools

Hash Generator

Bcrypt Generator

RSA Key Pair Generator

Text Encrypt / Decrypt

BIP39 Mnemonic Generator

Password Strength Analyser

twoworks

Hash-based Message Authentication Code (HMAC)

How HMAC works

Webhook security

Algorithm choices

Debugging tip