HMAC Generator
Compute an HMAC with SHA-256, SHA-384, SHA-512, SHA-1 or MD5, and a key that never leaves the page.
How to compute an HMAC
- Type or paste the message.
- Enter the key and choose whether it is text, hex or Base64.
- Choose the algorithm, and copy the HMAC as hex or Base64.
Questions
Is my key saved or sent anywhere?
No. The key stays on this page while it is open. It is never saved, put in the address bar or sent to any server.
How do I check a webhook signature?
Paste the request body as the message and your signing secret as the key, choose the algorithm the service uses, and compare the result with the signature it sent.
Why are there two results?
Services print HMACs either as hex or as Base64. Both are the same value written two ways.
Should I still use HMAC with SHA-1 or MD5?
They remain in older systems. For anything new, choose SHA-256 or stronger.