HMAC Signature Generator
Local ProcessingGenerate Hash-based Message Authentication Codes (HMAC) using SHA-256, SHA-1, SHA-384, or SHA-512 with a secret key.
How It Works & Processing Standards
Generate Hash-based Message Authentication Codes (HMAC) using SHA-256, SHA-1, SHA-384, or SHA-512 with a secret key.
Tool processing runs in your browser. If you create a calculator or conversion share link, its values are included in the URL. See the privacy policy for account, analytics and advertising data.
Current Limits
- Maximum input length: 2,000,000 characters
An HMAC is a hash mixed with a secret key, so only someone with the key can produce the same value. Choose message, key, hash and output format, and it is computed with Web Crypto.
The key never leaves your browser, but clear production keys from the screen when you are done.
What You Can Do
- Four hashes
- SHA-256, SHA-1, SHA-384 or SHA-512.
- Hex or Base64
- Match the signature format the service expects.
How to Use HMAC Signature Generator
- 1Enter the messagePaste the body to sign, such as a webhook payload.
- 2Set key and hashEnter the secret key and choose hash and output.
- 3CompareCompare the result with the signature header.
Examples
Common Use Cases
- Checking Stripe, GitHub or Slack webhook signatures by hand
- Producing expected values while writing API signing code
Frequently Asked Questions (FAQ)
My signature differs from the service.
One changed character changes the result. Make sure you used the exact body the service signed (usually the raw body, newlines included) and the right output format (hex or Base64).