Dev Tools Pack Logo

HMAC Generator

Generate HMAC-SHA256, SHA-512, SHA-384 and SHA-1 signatures in your browser, and verify webhook signatures from GitHub, Stripe, Shopify and Slack.

Built & Maintained by the devtoolspack Team

Last updated: September 2026

What is an HMAC?

An HMAC (Hash-based Message Authentication Code, RFC 2104) combines a cryptographic hash with a secret key. Anyone can recompute a plain SHA-256 hash, but only someone who holds the key can produce the right HMAC. That makes it the standard way to sign API requests and webhook payloads.

Where You Will Meet HMAC Signatures

  • GitHub webhooks: X-Hub-Signature-256: sha256=<hex> over the raw body.
  • Stripe webhooks: v1=<hex> over timestamp.body.
  • Shopify webhooks: X-Shopify-Hmac-Sha256, Base64 of HMAC-SHA256 over the raw body.
  • Slack requests: v0=<hex> over v0:timestamp:body.
  • JWTs signed with HS256: the signature is a Base64URL HMAC-SHA256 of header.payload.

The Most Common Mistake

Signatures are computed over bytes. If your server parses the JSON body and serialises it again, the whitespace or key order can change and the HMAC will no longer match. Always verify against the raw request body, and compare signatures with a constant-time function (for example crypto.timingSafeEqual in Node.js) in production code.

Related Tools

For unkeyed checksums use the Hash Generator. To inspect or create HS256 tokens, see the JWT Decoder and JWT Generator.

How to Generate and Verify an HMAC

  1. Enter the message: Paste the exact message or raw request body into Message.
  2. Enter the secret key: Type the shared secret and choose whether it is plain text, hex or Base64.
  3. Verify or copy: Paste a received signature into Verify to check it, or copy the HMAC you need.

Frequently Asked Questions

What is the difference between a hash and an HMAC?

A hash such as SHA-256 is computed from the message alone, so anyone can recompute it. An HMAC mixes in a secret key, so only someone who knows the key can produce a matching signature. This lets a receiver check that a message both came from the key holder and was not modified.

How do I verify a GitHub webhook signature?

Paste the raw request body as the message and your webhook secret as the key, then paste the X-Hub-Signature-256 header value (sha256=...) into Verify. The body must be byte-for-byte what GitHub sent; re-serialised JSON with different spacing will not match.

Why does my Stripe signature not match?

Stripe signs the string "timestamp.payload", not the payload alone. Take t=... from the Stripe-Signature header and use "<t>.<raw body>" as the message. The v1= value is the hex HMAC-SHA256 of that string.

Is it safe to paste my secret key here?

The HMAC is computed with your browser's built-in Web Crypto API, and neither the key nor the message leaves your device. As with any secret, avoid pasting production keys on shared machines.

Cite this Tool

Using this tool for a technical blog, research, or documentation? Copy a pre-formatted citation below to link back to devtoolspack.

APA Citation
devtoolspack. (2026). HMAC Generator. https://devtoolspack.dev/hmac-generator
MLA Citation
"HMAC Generator." devtoolspack, 2026, https://devtoolspack.dev/hmac-generator.