HMAC Generator
Enter a message and a secret key to create an HMAC signature with SHA-256, SHA-512, SHA-384, SHA-1 or MD5. Switch to Verify to check a signature you received, for example from a webhook. Everything runs locally in your browser.
–
All algorithms
Hex, Base64 and Base64URL are detected automatically. Prefixes like sha256= (GitHub webhooks) are ignored.
How to use the HMAC Generator
- Type or paste the message you want to sign. Choose Hex or Base64 if your payload is binary.
- Enter the secret key and pick its encoding: plain text, hex or Base64 (many APIs give Base64 secrets).
- Choose the algorithm and output format, for example HMAC-SHA256 in hex for most webhooks, or Base64URL for JWT signatures.
- Press Generate HMAC (it also updates as you type) and copy the result. The table shows every algorithm at once.
- To check a signature, open Verify signature, paste the value you received and press Verify Signature.
HMAC test vector you can check
The classic example uses the key key and the message The quick brown fox jumps over the lazy dog (both as UTF-8 text). Enter them above and you should get exactly these values:
| Algorithm | HMAC (hex) |
|---|---|
| HMAC-MD5 | 80070713463e7749b90c2dc24911e275 |
| HMAC-SHA1 | de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9 |
| HMAC-SHA256 | f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 |
Algorithms, block sizes and output lengths
| Algorithm | Block size | Output | Hex length | Base64 length | Typical use |
|---|---|---|---|---|---|
| HMAC-MD5 | 64 bytes | 128 bits | 32 | 24 | Legacy APIs, RADIUS |
| HMAC-SHA1 | 64 bytes | 160 bits | 40 | 28 | OAuth 1.0, TOTP/HOTP codes, older webhooks |
| HMAC-SHA256 | 64 bytes | 256 bits | 64 | 44 | Webhooks (GitHub, Stripe, Shopify), AWS SigV4, JWT HS256 |
| HMAC-SHA384 | 128 bytes | 384 bits | 96 | 64 | JWT HS384, TLS |
| HMAC-SHA512 | 128 bytes | 512 bits | 128 | 88 | JWT HS512, high-security signing |
Computing HMAC-SHA256 in code
Once you have checked a value here, you can produce the same signature in your application:
| Language | Code |
|---|---|
| Python | hmac.new(key.encode(), msg.encode(), hashlib.sha256).hexdigest() |
| Node.js | crypto.createHmac('sha256', key).update(msg).digest('hex') |
| PHP | hash_hmac('sha256', $msg, $key) |
| Command line | printf '%s' "$msg" | openssl dgst -sha256 -hmac "$key" |
When verifying in code, compare signatures with a constant-time function such as hmac.compare_digest in Python or crypto.timingSafeEqual in Node.js to avoid timing attacks.
Frequently asked questions
What is an HMAC?
HMAC (hash-based message authentication code) combines a secret key with a hash function such as SHA-256 to produce a signature for a message. Anyone with the same key can recompute it to confirm the message was not changed and came from someone who knows the key.
How is HMAC calculated?
HMAC(K, m) = H((K′ ⊕ opad) ‖ H((K′ ⊕ ipad) ‖ m)), where K′ is the key padded to the hash block size (64 bytes for MD5, SHA-1 and SHA-256, 128 bytes for SHA-384 and SHA-512), ipad is the byte 0x36 repeated and opad is 0x5c repeated. Keys longer than the block size are hashed first.
How do I verify a webhook signature?
Use the raw request body exactly as received as the message, your webhook secret as the key and the algorithm the provider documents (usually HMAC-SHA256). Compare the result with the signature header. In the Verify tab you can paste the header value directly, including prefixes such as sha256=.
Why does my HMAC not match?
The most common causes are a different key encoding (a Base64 secret typed as text), extra whitespace or a different line ending in the message, a JSON body that was re-formatted before signing, or the wrong algorithm. Check each of these and compare byte counts.
Is HMAC-MD5 or HMAC-SHA1 still secure?
HMAC is much more robust than the plain hash, and HMAC-SHA1 and HMAC-MD5 have no practical forgery attacks today. Still, use HMAC-SHA256 or stronger for anything new; MD5 and SHA-1 are provided for compatibility with older systems.
What is the difference between Base64 and Base64URL output?
Base64URL replaces + with - and / with _ and drops the = padding, so the value can be used safely in URLs and HTTP headers. JSON Web Tokens (JWT) use Base64URL for their HS256 signatures.
Is my secret key sent anywhere?
No. The HMAC is computed in your browser with the Web Crypto API and a local MD5 routine. Nothing is uploaded or stored.