Message

Secret Key

Algorithm

What is HMAC Generator?

HMAC (Hash-based Message Authentication Code) is a cryptographic signature that verifies both the integrity and authenticity of a message. It combines a secret key with a hash function (SHA-256, SHA-512, etc.) to produce a unique fixed-length signature. If even one character of the message or key changes, the HMAC output changes completely — this property is called the avalanche effect. HMAC is the standard mechanism used by Stripe, GitHub, Slack, AWS, and countless other services to sign webhook payloads. It is also used in API request authentication, JWT token signing, and message integrity verification in data pipelines. Unlike plain hashing, HMAC requires a secret key, so only parties who share the key can produce or verify the signature.

How to Use

Enter the message you want to sign in the Message field — this is the payload you need to authenticate.
Enter your secret key in the Secret Key field — this is the shared secret provided by the service (e.g., Stripe webhook signing secret).
Select the hash algorithm (SHA-256 is recommended and most widely used; SHA-512 for stronger security; SHA-1 only for legacy systems).
Click 'Generate HMAC' to produce the signature in hex format.
Copy the hex output and use it to verify message authenticity — compare it with the signature sent by the service.

Why Use This Tool?

Verify webhook signatures from Stripe, GitHub, Slack, AWS SNS, and other services

Sign API requests for authentication — prove that requests come from an authorized source

Ensure message integrity in data pipelines — detect tampering or corruption in transit

Uses the Web Crypto API for cryptographic operations — secure, standards-compliant computation

All computation happens in your browser — your secret key never leaves your device

Tips & Best Practices

SHA-256 is the most commonly used algorithm for HMAC — it is the default for Stripe, GitHub, and Slack webhooks.
Never share your secret key — store it securely in environment variables or a secrets manager, never in source code.
HMAC is not encryption — it only verifies authenticity and integrity, not confidentiality. Use encryption (AES, RSA) to protect content.
Use constant-time comparison when verifying HMACs in your code to prevent timing attacks — most languages provide a secure compare function.

Frequently Asked Questions

What is HMAC used for?

HMAC is primarily used for message authentication and integrity verification. Common use cases include: verifying webhook payloads (Stripe, GitHub, Slack, AWS), signing API requests, authenticating JWT tokens, and ensuring data hasn't been tampered with in transit.

When should I NOT use HMAC?

Do not use HMAC when: you need non-repudiation (use digital signatures with asymmetric keys instead); you need to encrypt data (HMAC only signs, it does not encrypt); you need multiple parties to verify without sharing a secret (use RSA/ECDSA signatures); or you need to hash passwords (use bcrypt, scrypt, or Argon2 instead).

Which algorithm should I use?

SHA-256 is the standard choice and is recommended for most use cases. SHA-512 provides stronger security but produces longer signatures. SHA-1 is deprecated for security purposes but may be needed for legacy systems. Use SHA-256 unless you have a specific reason to choose otherwise.

How do I verify a webhook signature?

Most webhook providers send an HMAC signature in a header (e.g., X-Signature-256, Stripe-Signature). To verify: take the raw request body, compute the HMAC with your webhook secret using the same algorithm, and compare the result with the signature from the header. If they match, the webhook is authentic.

Is my secret key safe?

Yes. The HMAC is computed entirely in your browser using the Web Crypto API. Your message and secret key are never sent to any server. However, be cautious when using online tools on shared or public computers — clear your browser data after use.

What's the difference between HMAC and digital signatures?

HMAC uses a shared secret key — both the sender and receiver must know the key. Digital signatures (RSA, ECDSA) use asymmetric keys — the sender signs with a private key, and anyone can verify with the public key. HMAC is simpler and faster but requires secure key distribution. Digital signatures provide non-repudiation.

Real-world Examples

Verifying a Stripe webhook signature

Stripe sends an HMAC-SHA256 signature in the Stripe-Signature header. Compute the HMAC of the raw request body with your webhook signing secret to verify the payload is authentic.

Input

Message: {"id":"evt_1234","type":"payment_intent.succeeded"}
Secret: whsec_abc123def456
Algorithm: SHA-256

Output

a1b2c3d4e5f6... (64-character hex string)

Signing an API request with HMAC

Many APIs require each request to include an HMAC signature of the request body or timestamp. This proves the request comes from someone who knows the secret key.