HMAC Generator
Sign a message with a secret key (SHA-1/256/384/512).
About HMAC Generator
The HMAC Generator signs a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512. HMACs are how webhooks (Stripe, GitHub, Slack and countless internal systems) prove authenticity, and how many APIs sign requests — which makes generating expected signatures a recurring QA task.
Enter the message (often a raw request body), the shared secret and the algorithm, and get the hex signature to compare against an X-Signature header or to embed in a test. Everything is computed locally with the Web Crypto API; your secret never leaves the page.
How to use
- Paste the exact message to sign into "Message" — for webhooks this is usually the raw request body, byte for byte.
- Enter the shared secret into "Secret key".
- Pick the "Hash algorithm" your system uses (SHA-256 is the most common).
- Click "Generate HMAC" and compare the hex output with the signature your system produced.
Frequently asked questions
Why doesn't my HMAC match the webhook signature?
The message must match byte-for-byte: re-serialized JSON, added whitespace or different line endings all change the signature. Sign the raw body exactly as received, and check whether the provider prefixes it (for example with a timestamp) before signing.
What is the difference between HMAC and a plain hash?
A plain hash proves only integrity; an HMAC mixes in a secret key, proving the message came from someone who knows that key. That is why webhook verification uses HMACs rather than bare SHA-256.
Is my secret key transmitted anywhere?
No — the signature is computed in your browser via the Web Crypto API. Still, prefer test-environment secrets over production ones as a general hygiene rule.