HMAC Generator
Generate an HMAC (hash-based message authentication code) from a message and a secret key, using SHA-1, SHA-256, SHA-384 or SHA-512. Output as hex or Base64. Everything is computed in your browser with the Web Crypto API.
New to this? Read the HMAC Generator guide →
—
—
The HMAC is computed with the Web Crypto API in your browser — your message and key never leave your device.
How to use the HMAC generator
- Enter the message and the secret key both sides share.
- Pick the hash (SHA-256 is the common choice for webhooks).
- Copy the resulting tag in hex or Base64. The same message and key always produce the same tag; change one byte of either and it changes completely.
The HMAC is computed with the Web Crypto API in your browser, so your message and secret key never leave your device.
HMAC vs. a plain hash
A plain hash like SHA-256 has no key, so anyone can recompute it: it proves a message is unchanged but not who sent it. HMAC mixes in a secret key, so a matching tag also proves the sender knew the key. That authenticity is the whole reason webhooks are signed with HMAC rather than a bare hash.
Verifying a webhook
- The provider signs the raw request body with your shared secret and sends the tag in a header.
- Your endpoint recomputes HMAC-SHA256(secret, raw_body) over the raw bytes (not re-serialized JSON) and compares.
- Compare in constant time (crypto.timingSafeEqual, hmac.compare_digest), never with ==, to avoid a timing attack.
For worked Node and Python verification snippets and the common pitfalls, read HMAC vs. hashing: how to verify webhooks.
Frequently asked questions
What is an HMAC?
An HMAC (hash-based message authentication code) is a code computed from a message and a secret key using a hash function such as SHA-256. Anyone who shares the key can recompute it to verify that the message is authentic and unchanged; without the key it cannot be forged.
How is HMAC different from a plain hash?
A plain hash like SHA-256 needs no key, so anyone can recompute it — it proves integrity but not authenticity. An HMAC mixes in a secret key, so it also proves the message came from someone who holds that key.
Is my message or key uploaded?
No. The HMAC is computed with the Web Crypto API in your browser; your message and secret key never leave your device.
Where you'd use this
Verifying webhook signatures, which is the difference between accepting instructions from your payment provider and accepting them from anyone who found the URL.
For example: Stripe sends a webhook with a Stripe-Signature header. Computing HMAC-SHA256 over the raw body with your signing secret and comparing proves the payload really came from Stripe and was not modified in transit.