How it works
How to use the HMAC Generator
Paste or open your input
Type, paste or drop a file into the left editor — or press Sample to try it.
Adjust the options
Pick the algorithm, enter the secret key (as text, hex or Base64) and choose hex or Base64 output.
Copy or download the result
Copy the output or download it as a file.
About the HMAC Generator
An HMAC (hash-based message authentication code, RFC 2104) proves that a message came from someone who knows a shared secret and was not modified. Webhooks from Stripe, GitHub, Shopify and Slack, AWS Signature v4 and JWT HS256 all use HMAC-SHA256.
Built for developers
Why developers use it
Private by design
Runs 100% in your browser. Nothing you paste is uploaded, logged or stored on a server.
Instant results
Output updates as you type, with precise error locations when something is wrong.
Works offline
Once loaded, the tool keeps working without a connection. Install it as an app if you like.
Free, no sign-up
No accounts, no limits, no watermarks.
FAQ
Frequently asked questions
How do I verify a webhook signature?
Paste the raw request body exactly as received, enter your endpoint’s signing secret, pick the provider’s algorithm (usually HMAC-SHA256) and compare the output with the signature header — many providers send it as hex, some as Base64.
Is my data uploaded anywhere?
No. Everything runs locally in your browser — nothing you type, paste or open is sent to a server, logged or stored. The tool keeps working offline once the page has loaded.
Keep going
Related tools
- SHA-256 Hash GeneratorGenerate SHA-256 hashes from text
- MD5 Hash GeneratorGenerate MD5 hashes from text
- Bcrypt Generator & CheckerHash passwords with bcrypt and verify hashes
- Password GeneratorGenerate strong, random passwords
- MD2 Hash GeneratorGenerate MD2 hashes from text
- MD4 Hash GeneratorGenerate MD4 hashes from text
- JSON Schema GeneratorInfer a JSON Schema from sample JSON
- UUID GeneratorGenerate UUID v4 / v7 in bulk and inspect UUIDs