Press Ctrl + D to bookmark HMAC Generator.
Open your browser menu (⋮ or the share icon) and tap Bookmark or Add to Home Screen.
Feedback on HMAC Generator
HMAC Generator & Verifier
Sign a message with a secret key, or check a webhook signature from GitHub, Stripe, Slack or Shopify. SHA-256, SHA-512, SHA-3 and more.
Paste the body exactly as received. Re-formatted JSON — even one changed space — gives a different signature.
No key yet — this is the HMAC with an empty key. Enter your secret above.
Signature
Header the sender adds
Signed JWT
Exact string that was signed
✓ Valid — the signature matches ().
✗ Doesn't match.
- Is the body byte-for-byte what was received (no re-formatting, same line endings)?
- Is it the right secret — for this endpoint, test mode vs live mode?
- Same algorithm? A 64-character hex signature is SHA-256; 128 is SHA-512.
That doesn't look like a signature. Paste hex or Base64, with or without its prefix.
Verify it in your code
Hash vs HMAC
Anyone can compute a plain hash with the Hash Generator. An HMAC mixes in a secret key, so only someone who has the key can make a matching signature.
Compare in constant time
Check signatures with timingSafeEqual, hmac.compare_digest or hash_equals, never ==. Also reject old timestamps (Stripe and Slack suggest 5 minutes) to stop replayed requests.
Testing webhooks?
Catch a real request with the Webhook Tester, then paste its raw body and signature header here. For tokens, see the JWT Decoder.
About the HMAC Generator
An HMAC is a hash of a message combined with a secret key. Services like Stripe and GitHub sign webhooks with HMAC so the receiver can prove a request is genuine and was not changed on the way.
How to use it
- 1 Pick a scheme, such as Stripe webhook, or Custom.
- 2 Enter the secret key and paste the raw request body or message.
- 3 Paste the signature you received to check it, or copy the signature in hex or Base64.
Frequently asked questions
Why does my webhook signature not match?
Most often the body was parsed and re-serialised before hashing. Sign the exact raw bytes received. Also check the secret (test and live modes have different ones), and whether the expected output is hex or Base64.
What is the difference between a hash and an HMAC?
Anyone can compute a hash. An HMAC also needs the secret key, so only the sender and receiver can produce it.
Is HMAC-SHA256 secure?
Yes, with a long random key. Compare signatures with a constant-time function to avoid timing attacks, and reject old timestamps to stop replayed requests.
What does Stripe sign?
Stripe signs the timestamp, a dot, and the raw body ("t.body") with HMAC-SHA256 using your endpoint secret. The Stripe-Signature header carries the timestamp as t= and the hex signature as v1=.
Is my secret key sent anywhere?
No. Signing runs in your browser and the key is never saved or uploaded. Use a test key anyway when you can.
Can I make a JWT here?
Yes. Choose JWT, enter the payload JSON and the secret, and you get a signed HS256, HS384 or HS512 token you can open in the JWT Decoder.