HMAC generator

What HMAC is for

An HMAC is a hash mixed with a secret key. Anyone can compute the SHA-256 of a message, but only someone who knows the key can produce its HMAC-SHA256, so the receiver can tell that a message really came from the sender and was not altered. Payment providers and platforms sign webhooks this way (Stripe, GitHub, Shopify, Paddle), exchanges sign API requests, and JWTs with HS256 are HMAC-SHA256 signatures.

To check a webhook, take the raw request body exactly as received, the shared secret, and compare the HMAC computed here with the signature header. A single extra space or a re-serialised JSON body gives a completely different result.

Worked example

RFC 4231's test case 2 signs what do ya want for nothing? with the key Jefe. HMAC-SHA256 gives 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, which this page reproduces. Changing the key to jefe changes the whole signature.

Key formats

Most services give the secret as plain text. Some give it as hex or Base64 bytes; choose that format so the bytes, not the characters, are used as the key.

The page encodes the message as UTF-8, decodes the key from the format you chose, and computes HMAC as defined in RFC 2104 using the browser's Web Crypto API: the key is padded to the hash block size, XORed with an inner and an outer constant, and the message is hashed twice. The signature is shown in hexadecimal and Base64, the two encodings services use in signature headers. The implementation is checked against the RFC 4231 test vectors. The key stays in this tab and is never stored.