HMAC Generator
Generate an HMAC signature with SHA-1, SHA-256, SHA-384 or SHA-512 — the standard way to sign webhooks and API requests.
Input
Secret
| Hex | ||
|---|---|---|
| Base64 |
What HMAC adds over a plain hash
A hash tells you whether data changed. An HMAC tells you whether it changed *and* that it came from someone holding the shared secret — because the secret is mixed into the computation in a way an attacker cannot replicate or extend.
That is why every serious webhook provider signs its payloads with HMAC: Stripe, GitHub, Slack and Shopify all send an HMAC-SHA-256 header you are expected to recompute and compare.
Verifying a webhook signature
- Paste the exact raw request body — not the re-serialized JSON, since even a changed space breaks the signature.
- Paste the signing secret from your provider dashboard, choosing the right encoding if it is hex or Base64.
- Pick the algorithm the provider documents, usually SHA-256.
- Compare the result with the signature header. Providers vary between hex and Base64, so check both rows.
In production, compare signatures with a constant-time function. A normal string comparison returns early on the first differing byte, which leaks enough timing information to forge a signature byte by byte.
Frequently asked questions
My signature does not match. What is usually wrong?
In order of likelihood: the body was parsed and re-serialized instead of used raw; the secret is Base64 or hex but was treated as plain text; a timestamp or version prefix that the provider requires was left out of the signed string.
Is HMAC-SHA-1 still safe?
HMAC-SHA-1 has no practical break, because HMAC does not rely on collision resistance the way a bare hash does. New systems should still use SHA-256.
Is my secret sent anywhere?
No. The HMAC is computed in your browser with Web Crypto, and no request is made at any point.