HMAC Generator
Free HMAC generator: compute HMAC-SHA256, SHA-1, MD5, SHA-512 or SHA-3 of text or a file with your key, in hex or Base64, and verify a signature in your browser.
How to use HMAC Generator
- 1Type or paste the message (or the raw webhook body), or choose a file.
- 2Enter the secret key as text, hex, Base64 or Base64URL, and pick the algorithm and output format.
- 3Copy the HMAC, or paste the expected signature into Verify to see Match or No match.
What makes it better
- HMAC with MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512 and SHA3-224 to SHA3-512
- Live result as you type, as hex, UPPERCASE hex, Base64 or Base64URL
- Key as text, hex, Base64 or Base64URL, with Show and Hide
- Verify a pasted signature, with prefixes like sha256= stripped, using a constant-time comparison
- GitHub webhook and Stripe-style presets, and files up to 100 MB
About HMAC Generator
HMAC Generator computes a keyed hash of your message with a secret key, using SHA-256, SHA-512, SHA-3, SHA-1 or MD5. The result updates as you type and can be shown as hex, Base64 or Base64URL, and a Verify box compares it with a signature you paste. Presets for GitHub and Stripe webhooks make it quick to debug a signature that will not match, and the calculation never leaves your browser.
Common uses
- Debug a GitHub webhook that your server rejects by recomputing X-Hub-Signature-256 from the raw body.
- Check a Stripe-style signature built from a timestamp, a dot and the payload.
- Generate a reference HMAC to test your own API request signing against.
- Authenticate a downloaded file or message with a shared secret.
Example
Input
The quick brown fox jumps over the lazy dog
Result
54cd5b827c0ec938fa072a29b177469c843317b095591dc846767aa338bac600
Good to know
- Example: the sample text with the key secret gives the HMAC-SHA256 shown above. Use a long, random key in real systems, because the key is the only secret.
- HMAC proves a message came from someone who knows the key and was not changed. It is not encryption: the message stays readable.
- HMAC-MD5 and HMAC-SHA1 are still considered secure for authentication, but prefer SHA-256 or stronger for anything new. On your server, compare signatures in constant time.
HMAC Generator FAQ
What is the difference between a hash and an HMAC?
A plain hash can be computed by anyone, so it only detects accidental changes. An HMAC mixes in a secret key, so only someone holding the key can produce or check it, which makes it suitable for authenticating messages.
How do I verify a GitHub webhook signature?
Take the raw request body exactly as received, compute HMAC-SHA256 with your webhook secret, and compare with the X-Hub-Signature-256 header, which starts with sha256=. Use the GitHub preset here and paste the header into Verify.
How does Stripe build its webhook signature?
Stripe signs the timestamp, a dot and the raw payload with HMAC-SHA256 and sends the hex result as v1 in the Stripe-Signature header. Pick the Stripe preset, enter the t value as the timestamp, and paste the header into Verify.
Why do I get a different HMAC from my code?
Check that the key is read in the same format, that the message is byte-identical (including line endings and any trailing newline), and that you used the same hash. Text is encoded as UTF-8 here.
Is HMAC-SHA1 or HMAC-MD5 still safe?
Collision attacks that broke SHA-1 and MD5 for signatures do not break their use inside HMAC, so existing systems are not in immediate danger. New designs should still choose SHA-256 or SHA-512 for a larger safety margin.