HMAC Generator
Compute HMAC signatures for webhooks and API requests, with the key as UTF-8 text, hex, or Base64, and output as hex or Base64.
Local workspace
Named projects in IndexedDB · Local only — never synced to our servers. Worksp…
Options
| Option | Description |
|---|---|
| Key | The shared secret. It is never saved, put in a URL, or sent anywhere. |
| Key encoding | How to read the key. Use the encoding your provider documents: a hex secret read as text produces a different signature. |
| Algorithm | The hash inside the HMAC. SHA-256 is the usual choice for webhooks. |
| Output | Match the encoding the signature header uses. |
FAQ
How do I check a webhook signature?
Sign the raw request body with the shared secret and compare the result to the signature header. Compare with a constant-time function in your code, and never re-serialize the JSON first: signing a reformatted body produces a different signature.
Why doesn't my signature match the header?
Usually one of four things: the body isn't byte-identical to what was sent, the provider signs a prefixed string such as a timestamp and a dot before the payload, the key is hex or Base64 rather than text, or the header uses Base64 while you compared hex.
Which key encoding should I choose?
Whichever form the provider gives you. A passphrase-style secret is UTF-8 text, a long string of 0-9 and a-f is usually hex, and a string ending in = is usually Base64.
Is HMAC-SHA1 still acceptable?
The SHA-1 collision attacks don't break HMAC-SHA1, so existing systems that use it aren't urgent to change, but anything new should use SHA-256 or better.
Does an HMAC encrypt the message?
No. It proves the message came from someone holding the key and wasn't altered. The message itself stays readable, so use TLS or encryption for confidentiality.