HMAC Generator

How to compute an HMAC

1. Paste the Message. For a webhook, this must be the raw request body, byte for byte.
2. Enter the Secret key and choose its Key format: Text (UTF-8), Hexadecimal or Base64.
3. Pick the Algorithm: HMAC-SHA1, HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512.
4. The result updates as you type; you can also click Generate HMAC. You get the HMAC (hex), the HMAC (Base64) and a Webhook signature header (GitHub style), each with a Copy button.
5. To check a signature you received, paste it in Compare with an expected signature (hex, Base64 or sha256=…). The tool says whether it matches.

The message is encoded as UTF-8 exactly as typed, including spaces and line breaks. The computation uses your browser’s Web Crypto API; the message and the key never leave your device.

What an HMAC is

An HMAC (hash-based message authentication code, RFC 2104) combines a secret key with a hash function:

HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m))

where K′ is the key padded to the hash block size (hashed first if it is longer), and ipad/opad are fixed constants. Only someone who knows the key can produce the right code for a message, and any change to the message changes the code completely. That is why HMACs sign webhooks, API requests (AWS Signature Version 4, for example) and HS256 JSON Web Tokens.

An HMAC is not encryption: the message is not hidden. It is also not a password hash; for storing passwords, use a slow function such as bcrypt or Argon2.

The output length depends on the algorithm: 20 bytes for SHA-1, 32 for SHA-256, 48 for SHA-384 and 64 for SHA-512. HMAC-SHA1 is still considered secure as a MAC, but prefer SHA-256 for new systems. A random key at least as long as the output (32 bytes for HMAC-SHA256) is recommended; hex or Base64 keys let you enter such random bytes directly.

Checking a GitHub webhook

GitHub signs each delivery with your webhook secret and sends the result in the X-Hub-Signature-256 header as sha256= followed by the hex HMAC-SHA256 of the body. GitHub’s own documentation example uses the secret It's a Secret to Everybody and the body Hello, World!; enter them here with HMAC-SHA256 and the header shows:

X-Hub-Signature-256: sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17

The comparison field accepts the whole header line, the sha256=… value, or a bare hex or Base64 signature (Stripe, Shopify and Slack use similar schemes with their own headers and signed strings). For SHA-384 and SHA-512 the tool shows a generic X-Signature header, since there is no common standard.

Constant-time comparison

A server that compares signatures with a normal string comparison stops at the first different character. By measuring response times, an attacker could guess a valid signature one character at a time. The comparison in this tool examines every byte whatever the result, as a server should with crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python or hash_equals in PHP.