HMAC Generator

How to use HMAC Generator

1. 1Paste the exact message or raw request body you want to sign.
2. 2Enter the secret key and choose whether it is plain text, hex or Base64.
3. 3Pick the algorithm. Most webhooks and APIs use HMAC-SHA256.
4. 4Copy the signature in hex or Base64, or paste a received signature to verify it.

What you can do

• Four algorithms

  HMAC with SHA-256, SHA-384, SHA-512 and legacy SHA-1, from the browser's Web Crypto API.

• Hex and Base64 output at once, matching how different providers send signatures.

• Signature verification

  Accepts hex or Base64 and ignores prefixes such as sha256=.

• Text, hex or Base64 keys

  Decodes the key the same way your provider documents it.

When this tool helps

About HMAC Generator

HMAC (hash-based message authentication code) combines a secret key with a hash function such as SHA-256 to produce a signature that only someone with the key can create. Webhook senders sign each request body this way, and the receiver recomputes the HMAC to prove the request is genuine and unchanged. Most mismatches come from signing different bytes: a parsed and re-serialised JSON body, an added newline, or a key that should have been decoded from hex or Base64 first. This tool signs exactly the text you paste as UTF-8, so paste the raw body. In your own code, compare signatures with a constant-time function rather than ==. HMAC is not encryption and not a plain hash: to fingerprint a file use the SHA-256 hash generator, to hide text use the text encryption tool, and to decode Base64 values use the Base64 decoder. The webhook signature guide walks through a full verification.

Sign a message with a secret key using HMAC-SHA256, SHA-384, SHA-512 or legacy SHA-1, and see the signature in hex and Base64. Paste a signature you received, including a sha256= prefix, to check it matches. Keys can be text, hex or Base64. Computed with the Web Crypto API; the key never leaves your device.

ToolsWebPro provides this tool free with no account required. Each tool explains its supported formats, processing limits and privacy behavior.

Frequently asked questions

How do I generate an HMAC-SHA256 signature?

Paste the message, enter the secret key, keep the algorithm on SHA-256 and copy the hex or Base64 result. Check whether your API expects hex or Base64.

Why does my webhook signature not match?

Usually the signed bytes differ. Sign the raw request body, not re-serialised JSON. Also check the key format: some providers give a hex or Base64 key that must be decoded, and some sign a timestamp plus the body.

Is the secret key sent anywhere?

No. The HMAC is computed with your browser's Web Crypto API. Still, avoid pasting live production secrets into websites, and rotate any key you think was exposed.

Can an HMAC be decrypted?

No. HMAC is a one-way signature. It proves who created a message and that it was not changed, but it does not hide or recover the message.

What is the difference between HMAC and SHA-256?

SHA-256 alone is a public fingerprint anyone can compute. HMAC-SHA256 mixes in a secret key, so only someone who knows the key can create a valid signature.

Related Security Tools

More free tools on ToolsWebPro — including companions that pair well with HMAC Generator.

• SHA-256 Hash GeneratorGenerate SHA-256, SHA-1, SHA-384 and SHA-512 hashes of text or files and compare them with a published checksum. Local, instant, no upload.
• Base64 Encoder & DecoderEncode text to Base64 or decode Base64 back to readable text. Handles UTF-8, emoji and URL-safe Base64URL. Converts as you type, nothing uploaded.
• Text Encryption ToolEncrypt a message or note with a password using AES-256-GCM, then decrypt it later. Runs in your browser — text and password are never uploaded.
• Password Security ToolGenerate cryptographically secure passwords and check hack vulnerability, entropy, and estimated crack time — 100% in your browser.