HMAC Generator
Sign a message with a secret key using HMAC-SHA256.
Input
This tool runs entirely in your browser. The data you paste or load is never uploaded.
Result
Enter your input, then run the tool.
About this tool
Computes an HMAC signature of a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512 through the browser’s Web Crypto API. Useful for checking webhook signatures and API request signing without sending the secret anywhere.
How to use it
- Enter the message exactly as it was signed.
- Enter the secret key and choose the hash algorithm.
- Press Sign and compare the signature with the one you received.
Frequently asked questions
Why does my signature not match the webhook header?
The message must be byte-for-byte identical, including whitespace and line endings. Many providers also prefix the header with “sha256=” or use Base64 instead of hex.
Is my secret key sent anywhere?
No. The key is imported into the Web Crypto API in this tab and never leaves your browser.
Keep going
Related tools
Hash Generator (SHA-256, SHA-1, SHA-512)
Compute SHA checksums of text in your browser.
Base64 Encoder
Encode text or UTF-8 data as Base64, including URL-safe output.
JWT Decoder
Inspect the header and claims of a JSON Web Token.
JSON Formatter
Pretty-print compact or broken JSON with a readable indentation.
JSON Validator
Check JSON syntax and see exactly where it breaks.
JSON Minifier
Strip whitespace from JSON to shrink payloads.