Compute an HMAC of a message with a secret key (SHA-256/1/384/512 or MD5), and check a received webhook signature from GitHub, Stripe or Shopify -- all in your browser. Fast, free, and built for simple browser-based workflows.
The HMAC is computed in this browser tab using the Web Crypto API and hand-written MD5. Your key and message are never sent anywhere.
Type a message above — the signature updates as you type.
Webhooks are signed over the exact bytes received. JSON that was pretty-printed, re-serialised, or copied from a log viewer will not match — and CRLF vs. LF or a trailing newline matter too. This is the most common reason a real signature "fails" here.
728 x 90 In-Content Ad
HMAC Generator is a free online tool that computes the HMAC of a message with a secret key, and checks a received webhook signature against it -- something the site's general-purpose Hash Generator deliberately doesn't do. Paste a message and key, pick an algorithm, and get a signature in HMAC-SHA-256, SHA-1, SHA-384, SHA-512 or MD5.
Paste a signature header you received -- GitHub's sha256=..., Stripe's t=...,v1=..., Shopify's Base64 value, or a plain hex string -- into the "Signature to check" field, and it detects the format automatically, computes the matching HMAC, and tells you whether they match. A Stripe signature is checked against the exact timestamp.body content Stripe actually signs, not the body alone, and every v1 value is tried while v0 is ignored. When a real signature doesn't match, the usual cause is that the body was re-serialized, pretty-printed, or had its line endings changed before being pasted -- webhooks are signed over the exact bytes received, and this tool says so right next to the result.
Both the key and the message stay in this browser tab; nothing is sent to a server, and the key field is masked by default with a Show toggle. Keys and messages that aren't plain text can be entered as hex or Base64 instead, matching how many webhook secrets are actually issued. HMAC-MD5 works even without a secure connection; the SHA variants rely on the browser's Web Crypto API, which needs HTTPS or localhost.
Paste the message, or raw webhook request body, into the box, and your secret key into HMAC key. Click "Try an example" to see RFC 2104's own test case.
Choose HMAC-SHA-256, SHA-1, SHA-384, SHA-512 or MD5, and whether to show the result as lowercase hex, uppercase hex, or Base64.
The HMAC appears automatically as you type, or press Generate HMAC (Ctrl+Enter also works from anywhere on the page) to run it on demand.
Paste a webhook's signature header into "Signature to check" -- it is detected and compared automatically, and tells you whether it matches.
Yes! All our tools are 100% free to use with no hidden costs, no registration required, and no credit card needed.
Absolutely. All tools run entirely in your browser (client-side). Your data never leaves your device and is not sent to our servers.
Yes, once the page is loaded, the tool will continue to work even if you lose internet connection since it runs in your browser.
There is no strict character limit, but very large amounts of text (100,000+ characters) may slow down your browser.
Yes! All our tools are free for both personal and commercial use.
The Hash Generator computes a plain hash of text with no key. This tool computes an HMAC -- a hash combined with a secret key -- and can also check a webhook signature you received against it, which the Hash Generator does not do at all.
It auto-detects GitHub's sha256=... / sha1=... header, Stripe's t=...,v1=... header, a plain Base64 value (such as Shopify's X-Shopify-Hmac-Sha256), and a plain hex value. Paste the header as-is into "Signature to check" and it tells you which format it found.
Not yet. Slack signs v0=... over v0:timestamp:body, a different construction from the formats above, and this tool does not currently detect or check it. It is on the backlog; for now, compute the HMAC manually by building that exact string as the message.
Almost always because the body was not hashed exactly as received. Pretty-printing JSON, re-serializing it, copying it out of a log viewer, or converting line endings between LF and CRLF all change the bytes -- and a webhook signature is computed over the exact bytes sent, not a re-formatted version of them.
Stripe signs the string formed by the timestamp, a literal dot, and the raw request body -- not the body by itself. This tool reconstructs that exact string from the t= value in the header and your pasted message, computes HMAC-SHA-256 over it, and compares the result against every v1 value in the header (v0 is ignored). It does not reject old timestamps itself; that check belongs to your server-side code.
No. An HMAC, like any hash, is one-way -- there is no calculation that turns a signature back into the key or the message. The only way to "check" one is to recompute it from a known key and message and compare, which is exactly what this tool's verify panel does.
No. The key field is masked like a password by default, the HMAC is computed entirely in this browser tab, and nothing you type here -- key, message or signature -- is ever sent to a server or saved. Clicking Clear wipes all three fields at once.
When a pasted signature names its algorithm -- a GitHub sha256=... or sha1=... prefix, or a hex value whose length only matches one algorithm -- the dropdown switches to match it so the comparison is correct, and a note next to the result says it happened. It never switches silently without explaining why.
Yes. The "More options" panel has a Key is selector for UTF-8 text, hex bytes, or Base64 bytes, separate from the same choice for the message -- useful since many services issue webhook secrets as a hex or Base64 string rather than plain text.
The SHA-family algorithms run through the browser's Web Crypto API, which browsers only expose on a secure context (HTTPS or localhost) for security reasons. HMAC-MD5 is hand-implemented in this tool rather than relying on that API, so it keeps working even on a plain HTTP page.