HMAC generator
Sign a message with a shared key — the key never leaves your browser.
Input
Result
The result will appear here.Webhook providers sign their requests with HMAC, and the fastest way to find out why your verification is failing is to compute the expected signature by hand. Enter the exact payload and the shared secret and compare. Because this runs in the page, the secret is never transmitted, and neither the key nor the signature is written to your history.
How it works
- The key and message are processed by WebCrypto in the page; nothing is sent anywhere.
- Output is hex or Base64, the two encodings webhook providers use.
- Nothing about a run is stored, not even in your own history, because the input is a secret.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
Free up to 20.0 KB per run without an account. Past that, a run costs 2 points and is saved to your history.
Points come from signing up, checking in daily, commenting and completing your profile.
See how points workCommon questions
- My signature does not match the provider's. What is wrong?
- Nine times out of ten the message is not byte-identical. Sign the raw request body exactly as received — before any JSON parse and re-serialise, which reorders keys and changes whitespace. Check whether the provider prefixes a timestamp or a version string.
- What is the difference between HMAC and a plain hash?
- A plain hash of a secret plus a message can be extended by an attacker who never learns the secret. HMAC's nested construction is designed to resist that, which is why every signing spec uses it rather than concatenation.
- Is it safe to paste a production secret here?
- The computation is local and nothing is transmitted or stored. That said, a secret you have pasted into a browser on a shared machine is a secret worth rotating.
The open-source behind it
This tool is a self-contained implementation. brix/crypto-js (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.
brix/crypto-jsAlso known as
- hmac generator
- hmac sha256
- webhook signature
- hmac online
- api signature generator