HMAC Generator
HMAC-SHA256/384/512/1 as hex and Base64, and verify a webhook signature.
About this tool
Enter the message (for a webhook, the raw request body), the secret key as text, hex or Base64, and the algorithm. The HMAC appears in hex, Base64 and Base64url with copy buttons. Paste a signature you received into the verify box to see whether it matches — a ‘sha256=’ prefix is accepted.
HMAC, webhooks and the usual bug
An HMAC (hash-based message authentication code) combines a secret key with a message using a hash function, producing a signature only someone with the key can create. Stripe, GitHub, Shopify, Slack and most other services sign their webhooks this way so your server can prove a request really came from them, and many APIs sign requests the same way; JWTs signed with HS256 are HMAC-SHA256 underneath. Verification means recomputing the HMAC over the received body with your secret and comparing it, in constant time, to the signature header. When it fails, the cause is almost always the message, not the maths: the body must be the raw bytes exactly as sent — parsing and re-serialising JSON changes whitespace and key order — and several providers sign a timestamp plus the body (Stripe signs ‘timestamp.body’), so check the documentation for the exact string. A known test value: key ‘Jefe’, message ‘what do ya want for nothing?’, SHA-256 gives 5bdcc146…ec3843. Computed with your browser's Web Crypto API; the key never leaves the page. The hash generator makes plain hashes, the JWT encoder signs tokens, the Base64 tool converts encodings, and How checksums verify downloads and backups — and which one to use explains hashing.
Frequently asked questions
What is the difference between a hash and an HMAC?
A hash (SHA-256) anyone can compute from the message. An HMAC also needs the secret key, so it proves the sender knows the key and the message wasn't changed.
Why doesn't my webhook signature match?
Usually the message differs: use the raw request body before JSON parsing, check whether the provider signs a timestamp too, and confirm the algorithm and key encoding.
Should the signature be hex or Base64?
It depends on the provider — GitHub uses hex with a sha256= prefix, Shopify uses Base64. The tool shows all three forms and verifies any of them.
Is my secret key sent anywhere?
No. The HMAC is computed locally with the Web Crypto API. Still, avoid pasting production secrets into any website.