About HMAC Generator
An HMAC proves two things about a message: it came from someone holding the secret key, and it has not been changed since. APIs and webhooks rely on this. A service signs each request with a shared secret, and your code recomputes the signature and compares. When that comparison fails, you need a way to work out why, which is what this page is for.
Enter the message and the key, and the signature appears in three formats at once. Paste the signature you were given into the compare box to see whether it matches. Since you may be working with a real secret, it matters that the calculation happens on your device and nothing is sent.
How it works
The page uses your browser's built-in Web Crypto API, and the algorithm is the one defined in RFC 2104. The hash can be SHA-256, SHA-384, SHA-512 or SHA-1. Web Crypto refuses an empty key, but under HMAC's padding rule a zero-length key and a single zero byte produce the same result, so an empty key is handled that way. Web Crypto is only available on https pages, so if you open a local copy over plain http you get a message saying so.
Both the message and the key can be read as text, hex or Base64. Text is encoded as UTF-8. The compare box accepts hex, Base64 or Base64URL, and strips a leading sha256= or 0x, so you can paste a header value as it arrives. It compares the bytes, so the format of your expected signature does not matter.
How to use HMAC Generator
- Type the Message and the Secret key, or press Try an example.
- Set the format of each to Text, Hex or Base64 if your values are encoded.
- Under Hash function, choose SHA-256, SHA-384, SHA-512 or SHA-1.
- Press Copy beside the Hex, Base64 or Base64URL result. To check a signature, paste it into Compare with a signature.
A real run on the page's example
Message: The quick brown fox jumps over the lazy dog
Secret key: key
Hash function: SHA-256Hex: f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Base64: 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=
Base64URL: 97yD9DBThCSxMpjmqm-xQ-9NWaFJRhdZl0edvC0aPNg
HMAC-SHA-256: 256 bits, from a 3 byte key and a 43 byte message.These are the same 32 bytes written three ways. The byte counts are worth reading when you debug, because a stray space or line ending changes the count and every digit of the result.
When it helps
- Debugging a webhook whose signature check keeps failing on your server
- Producing a test signature for an API client before the code is written
- Confirming that your own HMAC code matches a known answer
- Working out the signature part of an HS256 JWT by hand, using Base64URL output
- Comparing a hex signature against a Base64 one without converting them yourself
Tips for a better result
- When a check fails, the cause is usually the message. Many services sign the raw request body, and parsing and re-encoding it as JSON changes the spacing or key order. Sign the bytes you received.
- Watch for a line ending at the end of the message. Text copied from a terminal or a file may carry one that the sender did not sign.
- If your provider gives a key that looks encoded, check whether it should be used as text or decoded first. Setting the key format wrongly gives a clean-looking but wrong result.
- Choose SHA-256 unless a service tells you otherwise. In your own code, compare signatures with a constant-time function, so that response timing cannot give away how close a guess was.
Good to know
- It signs and compares only. It does not encrypt anything, and an HMAC does not hide the message.
- Timestamped signing schemes, where a provider combines a timestamp with the body before signing, need you to build that exact string yourself and paste it in as the message.
- In the compare box, only prefixes in the style of
sha256=and0xare stripped. Remove any other prefix yourself, or the value will not parse. - MD5 and SHA-3 are not offered.
- SHA-1 is included for older systems. HMAC-SHA-1 is not known to be broken, but use SHA-256 for anything new.
Questions people ask
Is it safe to paste a real secret here?
The calculation runs in your browser and the key is not sent or saved. Still, treat a production secret with care: a browser extension can read any page, so use a test key if you have one.
What is the difference between HMAC and a plain hash?
A hash takes only the message, so anyone can compute it. An HMAC also takes a secret, so only someone holding the key can produce a valid value. Use the Hash Generator if no key is involved.
Why does my signature not match the one from the service?
Almost always the input differs by a byte: a parsed body, an added line ending or a key in the wrong format. Check the byte counts under the result, then confirm the hash function.
Which output format should I use?
Whichever the other side expects. Hex is common in webhook headers, Base64 appears in many API docs, and Base64URL is what JWTs use, with no padding.
What to use next
- Hash Generator: when no secret key is involved
- JWT Decoder: to read the token whose signature you are checking
- Base64 Encode Decode: to look inside an encoded message or key
Last reviewed . Read our editorial policy.