Tools Tokens
HMAC Generator
HMAC-SHA256 and other HMAC signatures, and check webhook signatures.
🔒 Runs in your browser. Nothing is uploaded.- HMAC-MD5 legacy
74e6f7298a9c2d168935f58c001bad88- HMAC-SHA1 legacy
fbdb1d1b18aa6c08324b7d64b71fb76370690e1d- HMAC-SHA256
b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad- HMAC-SHA384
6c1f2ee938fad2e24bd91298474382ca218c75db3d83e114b3d4367776d14d3551289e75e8209cd4b792302840234adc- HMAC-SHA512
b936cee86c9f87aa5d3c6f2e84cb5a4239a5fe50480a6ec66b70ab5b1f4ac6730c6c515421b327ec1d69402e53dfb49ad7381eb067b338fd7b0cb22247225d47
How to use it
- Paste the message, for example a webhook body exactly as it was received.
- Enter the secret key and say whether it is plain text, hex or Base64.
- All five HMACs are calculated at once. Switch the output between hex and Base64 to match what you are comparing against.
- Paste the signature you were sent into "Compare" to check it. A prefix like sha256= is ignored.
Questions
Why doesn’t my webhook signature match?
Usually the message is not byte-for-byte what was signed. Use the raw request body, not a reformatted copy: a changed space, line ending or key order produces a completely different signature. Also check the output encoding (hex or Base64) and that the secret is in the right format.
Is the secret key saved?
No. It is never stored, not even in your browser, and the page’s security policy blocks it from being sent anywhere. Still, prefer a test secret, and rotate any production secret you have pasted somewhere you don’t control.
Are HMAC-MD5 and HMAC-SHA1 safe?
HMAC holds up better than plain MD5 or SHA-1, but both are legacy. Use HMAC-SHA256 or stronger for anything new; the older ones are here to check existing systems.