Does the secret leave my device?

Computation is local. Still avoid entering live production secrets on untrusted devices.

Why don’t signatures match my server?

Encoding (hex vs base64), newline differences, or wrong algorithms are common causes—normalize the exact byte string signed.

Can I verify Stripe or GitHub webhooks here?

You can experiment with the same algorithms, but follow each vendor’s exact signing string and header format.

HMAC Generator

Create HMAC-SHA signatures with a secret key.

Secret key

Message

Hash algorithm

HMAC (hex)

About this tool

Webhooks and APIs often verify HMAC signatures. This free HMAC generator computes hash-based message authentication codes from a message and secret. Use it locally while debugging signing mismatches—and never paste production secrets on a shared computer.

How to use

Enter the message payload to sign.
Enter the shared secret key used by your API.
Select the HMAC algorithm (for example SHA-256).
Generate and compare the signature to what your server expects.

Frequently asked questions

HMAC authenticates integrity and origin with a shared secret; it does not encrypt payload confidentiality by itself.

Related tools

Hash Generator

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes locally.