HMAC Generator
HMAC-SHA256, SHA-512 and more, with signature checks. Runs in your browser.
About this hmac generator
This HMAC generator computes a keyed hash (HMAC) of a message with a secret key, using SHA-256, SHA-384, SHA-512, SHA-1 or MD5. Developers use it to debug webhook signatures, sign API requests and check test vectors.
Enter the key as text, hex or Base64, type or paste the message, and the HMAC updates as you type. Output comes as hex, Base64 or Base64URL. Paste a signature you received and the tool tells you whether it matches, using a constant-time comparison.
Built-in examples show how GitHub, Stripe, Slack and Shopify style webhooks build their signed text and header. Everything runs in your browser, so your secrets stay on your machine.
Features
Five algorithms
HMAC-SHA256, SHA-384 and SHA-512 through the browser's Web Crypto API, plus SHA-1 and MD5 for older systems.
Key in any format
Text (UTF-8), hex or Base64. URL-safe Base64 works too. The byte count is shown so you can spot a key that was decoded the wrong way.
Signature verification
Paste a hex or Base64 signature. Prefixes like sha256= or v1= are stripped for you, and the match check is constant-time.
Helpful mismatch messages
If a signature is the wrong length for the algorithm, you're told. If it's the right length but different, you see the first byte that differs.
Webhook examples
One click loads a GitHub, Stripe, Slack or Shopify style example with the exact signed string and the header it produces.
Files of any size
Switch to File and the HMAC is computed in 8 MB chunks with a progress bar, so large files don't run out of memory.
How to use the hmac generator
- 1Pick an algorithm and enter the secret key as text, hex or Base64.
- 2Type the message or choose a file. The HMAC updates as you type.
- 3Paste a received signature to check it, or try a webhook example.
When to use it
Debug a webhook that fails verification
Paste the raw body and your signing secret, then compare the result with the header your server received.
Sign an API request
Many APIs ask for an HMAC of the method, path, timestamp and body. Build the string, sign it here and compare with what your client sends.
Check a JWT signature by hand
An HS256 JWT signature is HMAC-SHA256 of header.payload in Base64URL. Choose Base64URL output to compare, after you decode the JWT to read its parts.
Confirm a library against test vectors
RFC 4231 lists known inputs and outputs for HMAC-SHA-2. Enter one and check your code gives the same answer.
What is HMAC?
HMAC stands for hash-based message authentication code. It is defined in RFC 2104 and FIPS 198-1. It mixes a secret key into a hash function in two passes, so only someone who knows the key can produce the right output.
A plain hash from the hash generator proves a file wasn't damaged, but anyone can recompute it. An HMAC proves the message came from someone holding the key and wasn't changed on the way. It does not hide the message. For secrecy you need encryption, such as the AES encryption tool.
The output length follows the hash: 32 bytes for SHA-256, which is 64 hex characters or 44 Base64 characters.
How do webhook signatures work?
The sender and receiver share a secret. The sender computes an HMAC of the request body (sometimes with a timestamp in front) and puts it in a header. The receiver computes the same HMAC from the raw body it got and compares the two.
- GitHub style: X-Hub-Signature-256: sha256= followed by the hex HMAC-SHA256 of the raw body.
- Stripe style: Stripe-Signature: t=timestamp,v1=hex. The signed text is the timestamp, a dot, then the raw body. Receivers reject timestamps older than a few minutes to stop replays.
- Slack style: X-Slack-Signature: v0= followed by hex. The signed text is v0:timestamp:body.
- Shopify style: X-Shopify-Hmac-Sha256 holds the HMAC-SHA256 of the body in Base64, not hex.
Why doesn't my HMAC match?
Almost every mismatch comes down to bytes that differ between the two sides, even when the text looks the same.
- The body was parsed and re-serialized. JSON with different spacing or key order is a different message. Always sign the raw bytes.
- A trailing newline. Copying a body from a terminal often adds \n at the end.
- The key format. A secret shown as hex should usually be entered as Hex, not Text. A 64-character hex key is 32 bytes as hex but 64 bytes as text.
- Hex versus Base64 output, or uppercase versus lowercase hex.
- The wrong algorithm, such as SHA-1 in a header that expects SHA-256.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Where it runs | Web Crypto in your browser | Key and message posted to a server |
| Key formats | Text, hex or Base64 with byte count | Text only |
| Verify a signature | Constant-time compare, prefixes stripped | Compare by eye |
| Output | Hex, Base64 or Base64URL | Hex only |
| Webhook help | GitHub, Stripe, Slack and Shopify style examples | A short paragraph |
| Files | Any size, read in chunks | Text only |
Tips
- Use a random key at least as long as the hash output. Press Random 256-bit key for a 32-byte key in hex.
- When comparing signatures in your own code, use a constant-time function such as crypto.timingSafeEqual in Node or hmac.compare_digest in Python.
- Webhook timestamps are Unix seconds. Use the timestamp converter to see when a request was signed.
- If a Base64 key looks odd, check what it decodes to with the Base64 decoder.
- Prefer HMAC-SHA256 for new work. SHA-1 and MD5 are here for compatibility with older APIs.
Questions
What is an HMAC generator used for?
It computes a keyed signature of a message so you can check webhook headers, sign API requests or test your own code. Only someone with the same secret key can produce the same HMAC.
Is HMAC the same as encryption?
No. HMAC proves who sent a message and that it wasn't changed, but the message stays readable. Encryption hides the content. Many systems use both together.
How do I verify an HMAC-SHA256 signature?
Enter the same key and the exact raw message, choose HMAC-SHA256, then paste the received signature into the verify box. The tool shows Valid signature or the first byte that differs.
Should the output be hex or Base64?
Use whatever the other side expects. GitHub, Stripe and Slack send hex. Shopify sends Base64, and JWTs use Base64URL without padding. The bytes are identical, only the text encoding differs.
How long should an HMAC key be?
At least as long as the hash output: 32 bytes for HMAC-SHA256, 64 bytes for HMAC-SHA512. RFC 2104 says longer keys add little, and shorter ones weaken the MAC. Use random bytes, not a word.
Is HMAC-SHA1 still safe?
For HMAC, SHA-1 has no practical break yet, because HMAC doesn't rely on collision resistance. It is still considered legacy. Use HMAC-SHA256 for anything new.
Is my secret key sent anywhere?
No. The HMAC is computed in your browser with Web Crypto, or a local WebAssembly engine for MD5 and files. No key, message or file leaves the page.
Why does my webhook signature fail even with the right secret?
Usually the body you signed isn't byte-for-byte the raw request. Frameworks often parse and re-serialize JSON, which changes spacing. Sign the raw body, check for a trailing newline, and confirm the key format.