HMAC Generator
Sign a message with a secret key using HMAC SHA-1, SHA-256, SHA-384, or SHA-512, and copy the hex digest to verify a webhook or API payload.
How to use
- Type the message to sign.
- Set the secret key and the algorithm.
- Copy the digest and compare it with the value the provider sent.
An HMAC is a keyed hash. The same message signed with the same secret always gives the same digest, and any change to either produces a different one, which is how webhook signatures are checked.
Output
Paste or type something above.
Questions about hmac generator
- How do I verify a webhook signature?
- Sign the raw request body with the same secret and algorithm, then compare the digest with the signature header using a constant-time comparison.
- Which algorithm should I use?
- SHA-256 or SHA-512. SHA-1 still appears in older providers, and the tool flags it as legacy.
- Does the secret matter for length?
- Yes. A short secret weakens the signature, so use at least 32 random characters.
Related tools
- Hash Generator Hash text with MD5, SHA-1, SHA-256, SHA-384, or SHA-512, compare the digests side by side,...
- JWT Generator Create a signed JSON Web Token in the browser with HS256, HS384, or HS512, adding issued-a...
- JWT Secret Generator Create random signing secrets for JSON Web Tokens with a length, alphabet, and batch size...