Hmac generator

An HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to create a signature for a message. Anyone who knows the key can recompute it to confirm that the message was not changed and came from someone holding the key. HMAC is used to sign webhooks, API requests, JWTs (HS256) and cookies.

How to use it

1. Enter the message, for example a webhook body.
2. Enter the secret key.
3. Choose the hash algorithm, usually SHA-256.
4. Copy the HMAC in hex or Base64 and compare it with the expected signature.

Example

HMAC-SHA256 of the message The quick brown fox jumps over the lazy dog with the key key is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.

Verifying webhooks

Services such as Stripe, GitHub, Shopify and Razorpay send a signature header with each webhook. To verify it:

• Use the raw request body, exactly as received. Parsing and re-serialising JSON changes spacing and breaks the signature.
• Include any extra data the provider specifies, such as Stripe's timestamp prefix.
• Compare signatures with a constant-time function to avoid timing attacks.
• Reject old timestamps to prevent replay attacks.

Why not just hash the key and message together?

Naive constructions like SHA256(key + message) are vulnerable to length-extension attacks. HMAC's nested design avoids this, even with SHA-256.

Calculations run locally; your secret key never leaves the browser.