HMAC Generator

Runs in browser Security

Compute keyed-hash message authentication codes with a secret key, as used by Stripe, GitHub, Shopify and most webhook providers. Runs locally; secrets are never transmitted.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use HMAC Generator

  1. Paste the exact raw request body or message.
  2. Enter the secret and choose its encoding (text, hex or Base64).
  3. Pick the algorithm your provider uses (usually HMAC-SHA256).
  4. Optionally add the timestamp from the provider's header and paste the received signature to verify it.
  5. Copy the signature in hex or Base64.

HMAC Generator features

  • HMAC-SHA256, SHA-1, SHA-384 and SHA-512 with WebCrypto
  • Key as UTF-8 text, hex or Base64 bytes
  • Optional Stripe-style "timestamp.payload" signing input
  • Verify a received signature (accepts sha256=, v1= prefixes, hex or Base64)
  • Ready-made header formats for GitHub, Shopify and Stripe webhooks
  • Secrets never leave the browser

HMAC Generator example

HMAC-SHA256 with the classic test vector

Input:

Message: The quick brown fox jumps over the lazy dog
Key: key

Output:

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Frequently asked questions about HMAC Generator

How do I verify a Stripe webhook signature?

Stripe signs "timestamp.rawBody" with HMAC-SHA256 using your endpoint secret. Paste the raw request body, enter the secret, put the t value from the Stripe-Signature header in the timestamp field and compare with the v1 value.

How do I verify a GitHub webhook?

GitHub sends X-Hub-Signature-256: sha256=<hex>. Compute HMAC-SHA256 of the raw body with the webhook secret and compare the hex output; the tool strips the "sha256=" prefix automatically.

Why does my signature not match?

Usually because the body was re-serialised (whitespace or key order changed), the key was Base64/hex but treated as text, a timestamp prefix was missing, or a trailing newline was added. Always sign the exact raw bytes.

Should the key be hex, Base64 or text?

Whatever the provider gives you. Shopify and GitHub secrets are plain text; some APIs supply Base64 keys. Choose the matching "Key encoding" so the bytes are correct.

What is HMAC exactly?

HMAC (RFC 2104) combines a secret key with a hash function so that only parties holding the key can create or verify the tag. Unlike a plain hash of key+message, it is not vulnerable to length-extension attacks.

Technical notes

HMAC (RFC 2104) computes H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ message)). Keys longer than the hash block size are hashed first; shorter keys are zero-padded. The tool imports the key with crypto.subtle.importKey and signs with crypto.subtle.sign, so the result matches server-side libraries byte for byte when the same raw bytes are signed.