About The HMAC Generator

HMAC Generator creates keyed message authentication codes from a message and shared secret. It is built for webhook checks, API signing tests, custom signature headers, and integration debugging.

The signature is generated locally in your browser with Web Crypto when available. Keep real production secrets out of screenshots, logs, and shared sessions.

How to Generate HMAC Signatures Online

1. Paste the exact message or payload that needs signing.
2. Enter the shared secret key.
3. Select SHA-256, SHA-384, or SHA-512 and generate the digest.

Choosing Options Correctly

Match the algorithm required by the service you are testing. Signature mismatches usually come from different whitespace, a different secret, or signing a different canonical payload.

Common Use Cases

• Comparing webhook signatures during local development.
• Checking API request signing examples.
• Reproducing a signature mismatch from logs or support tickets.

Quick FAQ

Is HMAC just a hash?
No. HMAC combines a secret key with a hash function so the result proves knowledge of the key.

Can I verify production secrets here?
Avoid pasting production secrets into general-purpose tools. Use test keys or a local trusted workflow for sensitive systems.

Why might my server signature differ?
Differences in raw payload bytes, encoding, newline handling, timestamp prefixes, or hex/base64 output format can change the signature.

Should I parse JSON before verifying?
No. Sign and verify the exact raw bytes required by the provider, not a reformatted version.