Security & Crypto
HMAC Generator
HMAC-SHA signatures for webhooks and API request signing, in hex and Base64.
Loading the HMAC Generator…
About the HMAC Generator
Generate an HMAC signature for a message and secret key, the scheme used to sign webhooks and API requests by Stripe, GitHub, Slack, Shopify and AWS. Keys can be text, hex or Base64, and the signature is shown in hex, Base64 and Base64url.
How to use it
- Paste the exact message body.
- Enter the secret and its format.
- Compare the signature with the one you received.
Frequently asked questions
- Why doesn’t my webhook signature match?
- The message must be the raw request body byte for byte, before any JSON parsing or re-formatting. Some providers also sign a timestamp prefix together with the body.
- Is HMAC-SHA1 still safe?
- HMAC-SHA1 is still considered secure as a MAC, but prefer HMAC-SHA256 for new systems.
- Is my secret uploaded?
- No. Everything runs in your browser tab with JavaScript. Nothing you enter is uploaded, logged or stored, and the page works offline once loaded.