Generate HMAC signatures (SHA-1, SHA-256, SHA-512) for API and webhook testing.
Updated
Quick start
Set message, secret and algorithm to create signature.
Paste payload and secret key.
Choose SHA-1, SHA-256 or SHA-512.
Copy resulting hex digest.
In-depth guide
An HMAC (Hash-based Message Authentication Code) proves two things at once: that a message has not been altered, and that it came from someone who holds a shared secret. It is the mechanism behind GitHub and Stripe webhook signatures, signed download URLs and many API authentication schemes. This tool computes HMAC-SHA1, HMAC-SHA256 and HMAC-SHA512 in your browser with WebCrypto.
HMAC folds the shared secret into a cryptographic hash of the message in a specific two-pass construction. The result is a fixed-length hex digest that changes completely if even one byte of the message or the key changes. Crucially, you cannot forge a valid digest without knowing the secret, which is what makes it an authentication code rather than a plain checksum.
To verify an incoming webhook, compute the HMAC of the received body with your secret and compare it to the signature header — they must match exactly.
Reach for HMAC when both parties can share a secret in advance — webhook verification, signed URLs, internal service-to-service calls. When the verifier should not hold the signing key (for example, public token verification), use asymmetric signatures such as RSA or ECDSA / JWT RS256 instead.
HMAC-SHA1, HMAC-SHA256 and HMAC-SHA512, computed in the browser with the WebCrypto API.
A plain hash anyone can recompute. HMAC mixes in a shared secret, so only someone with that secret can produce a valid digest — it authenticates the sender as well as detecting tampering.
Yes. The same message, secret and algorithm always produce the same digest, which is how a receiver can verify a signature.
Almost always because the body was re-serialised before hashing. Sign and verify the exact raw bytes you received; reformatting JSON changes the digest.
Use RSA or ECDSA (or JWT RS256) when the party verifying the signature should not be able to create one — for example, public token verification across many services.
No. The message, secret and digest are processed locally via WebCrypto and never uploaded.
Keep exploring
Hand-picked utilities that pair well with the one you're on — all free, client-side, and zero-signup.
Encrypt and decrypt text locally with AES-256-GCM and passphrase-derived keys.
Generate signed HS256 JWTs from custom header and payload JSON locally.
Generate 6-digit rolling TOTP codes and otpauth URIs from Base32 secrets.
Shrink PDF file size without uploading to a server.
Body Mass Index with metric / imperial inputs and WHO category bands.
Combine multiple PDFs into one in your browser.
Split a PDF by pages or page ranges, download as zip.