In short: HMAC is a keyed hash: it combines a secret key with a message using a hash function such as SHA-256, producing a signature that proves the message came from someone who knows the key.
About HMAC Generator
Stripe, GitHub, Shopify, Slack and many other services sign webhook requests with HMAC-SHA256 so you can confirm a request is genuine. When your verification code says “signature mismatch”, computing the expected value by hand is the fastest way to find out whether the problem is the secret, the encoding or the exact bytes of the body.
This generator uses the browser’s Web Crypto API and shows the result as lowercase hex and Base64 at once. Paste the signature you received into the compare box to check it. Remember that services sign the raw request body — re-serialized JSON with different spacing will give a different signature.
How to use HMAC Generator
- Paste the exact message or request body.
- Enter the secret key and choose its format and the hash algorithm.
- Read the HMAC in hex and Base64; optionally paste an expected signature to compare.
Examples
Key Jefe, message what do ya want for nothing?, SHA-256 → 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
GitHub sends X-Hub-Signature-256: sha256=<hex>. Compute HMAC-SHA256 of the raw body with your webhook secret and compare the hex part.
Frequently asked questions
Why does my signature not match?
The most common causes are a different body (whitespace, key order, line endings), the wrong secret or key format (some services give a Base64 or whsec_-prefixed key), or comparing hex with Base64.
Is SHA-1 HMAC still safe?
HMAC-SHA1 is not broken in the way plain SHA-1 collisions are, but SHA-256 is recommended for anything new.
Is my secret uploaded?
No. All computation happens locally with crypto.subtle. You can check this yourself: open your browser’s developer tools, switch to the Network tab and use the tool — no request carries your input.
What is the difference between a hash and an HMAC?
A plain hash (like SHA-256) can be computed by anyone. An HMAC also requires the secret key, so only parties with the key can create a valid signature.
Updated November 2026 · Free, no signup · How we build and test tools