HMAC Generator

A SHA-256 hash of "hello" is always the same: anyone can compute it. An HMAC-SHA256 of "hello" produces a different result for every secret key. Plain hashing gives you integrity (detect tampering). HMAC gives you integrity plus authentication (prove who signed it). This is why APIs use HMAC for request signing, not plain SHA-256.

HMAC-SHA256 is the industry default and what most services use: AWS Signature Version 4, Stripe webhooks, GitHub webhooks, Shopify webhooks. HMAC-SHA512 provides extra security margin and is faster than SHA-256 on 64-bit hardware. HMAC-SHA384 is rarely needed. Avoid HMAC-SHA1 for new projects — use it only when integrating with legacy systems that require it.

Both represent the same HMAC value in different encodings. Hex (hexadecimal) produces 64 characters for HMAC-SHA256 — easier to read and compare manually. Base64 produces 44 characters — more compact, commonly used in HTTP Authorization headers, JWT signatures, and API request headers. Check which format your target service expects before generating.

When you receive a webhook from Stripe, the payload comes with an X-Stripe-Signature header containing an HMAC-SHA256 of the raw body, signed with your endpoint's secret key. To verify: compute HMAC-SHA256 of the raw request body using your secret, then compare to the header value. If they match, the webhook is genuine. GitHub uses X-Hub-Signature-256 the same way. This tool lets you compute and verify these signatures without writing code.

For HMAC-SHA256, the recommended key length is at least 32 bytes (256 bits) — matching the hash output size. Shorter keys reduce security; longer keys are fine. Never use human-memorable strings as keys — they are too predictable. Generate keys with a cryptographically secure RNG and store them in environment variables or a secrets manager, never in source code.

Generate an HMAC, then paste an expected HMAC value into the Compare field. The tool compares the two values and reports whether they match. This is useful for verifying webhook signatures: compute the expected HMAC from the received payload and your key, then compare to the signature in the request header. A match confirms the webhook is authentic.

Never. All HMAC generation uses the Web Crypto API (window.crypto.subtle.sign), which runs entirely in your browser. Your key, message, and HMAC output are never transmitted to any server. You can disconnect from the internet and the tool works identically.