HMAC Generator

Runs in browser Security

Compute keyed-hash message authentication codes with a secret key, as used by Stripe, GitHub, Shopify and most webhook providers. Runs locally; secrets are never transmitted.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

What is an HMAC?

An HMAC (hash-based message authentication code) combines a secret key with a hash function such as SHA-256 to produce a tag that proves a message was created by someone holding the key and was not altered afterwards. It is what signs HS256 JWTs and most webhook payloads; verifying one means recomputing it with the same key and comparing in constant time.

The provider signs the exact raw bytes with a shared secret; checking a delivery means recomputing the HMAC over the same bytes and comparing it with the received signature.

  1. The provider signs

    1. 1HMAC of the raw body with the shared secretUsually HMAC-SHA256; Stripe signs timestamp.rawBody
    2. 2Sends the body and a signature headerX-Hub-Signature-256: sha256=<hex>

  2. You check the delivery

    1. 3Recompute over the exact raw bytesRaw body, the secret in its key encoding and, for Stripe, the t value as the timestampThis tool
    2. 4Compare with the received signaturePasted with or without sha256= or v1=: it matches or it does notThis tool

      Branch: Body re-serialised, key encoding wrong, timestamp prefix missing or a trailing newlineFail

Outside the sequence
  • In production: your serverRepeats steps 3–4 on every delivery and compares in constant time

How to use HMAC Generator

  1. Paste the exact raw request body or message.
  2. Enter the secret and choose its encoding (text, hex or Base64).
  3. Pick the algorithm your provider uses (usually HMAC-SHA256).
  4. Optionally add the timestamp from the provider's header and paste the received signature to verify it.
  5. Copy the signature in hex or Base64.

HMAC Generator features

  • HMAC-SHA256, SHA-1, SHA-384 and SHA-512 with WebCrypto
  • Key as UTF-8 text, hex or Base64 bytes
  • Optional Stripe-style "timestamp.payload" signing input
  • Verify a received signature (accepts sha256=, v1= prefixes, hex or Base64)
  • Ready-made header formats for GitHub, Shopify and Stripe webhooks
  • Secrets never leave the browser

HMAC Generator example

HMAC-SHA256 with the classic test vector

Input:

Message: The quick brown fox jumps over the lazy dog
Key: key

Output:

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Frequently asked questions about HMAC Generator

How do I verify a Stripe webhook signature?

Stripe signs "timestamp.rawBody" with HMAC-SHA256 using your endpoint secret. Paste the raw request body, enter the secret, put the t value from the Stripe-Signature header in the timestamp field and compare with the v1 value.

How do I verify a GitHub webhook?

GitHub sends X-Hub-Signature-256: sha256=<hex>. Compute HMAC-SHA256 of the raw body with the webhook secret and compare the hex output; the tool strips the "sha256=" prefix automatically.

Why does my signature not match?

Usually because the body was re-serialised (whitespace or key order changed), the key was Base64/hex but treated as text, a timestamp prefix was missing, or a trailing newline was added. Always sign the exact raw bytes.

Should the key be hex, Base64 or text?

Whatever the provider gives you. Shopify and GitHub secrets are plain text; some APIs supply Base64 keys. Choose the matching "Key encoding" so the bytes are correct.

What is HMAC exactly?

HMAC (RFC 2104) combines a secret key with a hash function so that only parties holding the key can create or verify the tag. Unlike a plain hash of key+message, it is not vulnerable to length-extension attacks.

Technical notes

HMAC (RFC 2104) computes H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ message)). Keys longer than the hash block size are hashed first; shorter keys are zero-padded. The tool imports the key with crypto.subtle.importKey and signs with crypto.subtle.sign, so the result matches server-side libraries byte for byte when the same raw bytes are signed.

References