HMAC Generator
Compute HMAC-SHA-256 or HMAC-SHA-512 signatures in your browser. Your key and message stay on your device.
Pure browser JavaScript — uses the Web Crypto API (crypto.subtle).
How to use this tool
- Enter the message and secret key.
- Choose HMAC-SHA-256 or HMAC-SHA-512.
- Click Sign — copy the hex or Base64 digest.
Compute HMAC-SHA-256 or HMAC-SHA-512 signatures in your browser. Your key and message stay on your device.
How it works
HMAC (Hash-based Message Authentication Code) is a way to verify both the integrity and the authenticity of a message. Unlike a plain hash, HMAC requires a secret key. Only someone who knows the key can produce or verify the signature, which means recipients can confirm the message was not tampered with and came from a party that holds the key.
This tool computes HMAC-SHA-256 or HMAC-SHA-512 signatures entirely in your browser using the Web Crypto API. Your key and message text never leave your device.
Common uses include signing webhook payloads (GitHub, Stripe, and many other services use HMAC-SHA-256), generating API request signatures, and verifying that configuration values have not been modified.
To verify a signature, compute the HMAC of the received message using your shared secret and compare the result against the signature provided by the sender. Use a constant-time comparison in production code to avoid timing attacks.
Worked example
Verify a Stripe webhook signature
- Copy the raw webhook request body exactly as received (do not parse or pretty-print it).
- Locate your Stripe webhook signing secret in the Stripe dashboard.
- Paste the body into the Message field and the signing secret into the Key field.
- Select HMAC-SHA-256 and click Generate.
- Compare the result against the value in the Stripe-Signature header (after the 'v1=' prefix).
A 64-character hex digest. If it matches the header value, the webhook is authentic.
Common mistakes to avoid
- Using the public API key instead of the secret signing key -- only the secret key produces a valid HMAC.
- Adding a trailing newline or extra whitespace to the message before hashing, which changes the digest and causes verification to fail.
- Sharing the secret key in client-side code or logs -- the security of HMAC depends entirely on keeping the key private.
Key terms
- HMAC
- Hash-based Message Authentication Code -- a digest computed from a message and a secret key, used to verify both integrity and authenticity.
- Shared secret
- A key known to both the sender and receiver. Anyone with the key can create or verify a valid HMAC.
- Signing secret
- The specific term used by services like Stripe or GitHub for the shared key they use to sign webhook payloads.
Frequently asked questions
- Is the key sent anywhere?
- No — signing is done locally by crypto.subtle; nothing is transmitted.