How to generate an HMAC
- Enter the secret key in the key field.
- Paste the message, for example the raw request body of a webhook, or drop a file.
- Copy the HMAC in hex or Base64, depending on what the API expects. HMAC-SHA256 is shown first.
- Paste the signature you received into Compare to check that it matches.
What HMAC does
An HMAC (hash-based message authentication code) combines a secret key with a hash function. Only someone who knows the key can produce the correct value, so a matching HMAC proves that a message came from a trusted sender and was not changed on the way. That is how Stripe, GitHub, Shopify, Slack, Twilio and many other services sign their webhooks, and how AWS Signature V4 and many REST APIs authenticate requests.
When a webhook signature does not match, the cause is almost always the input rather than the algorithm. Hash the raw request body exactly as received: parsing and re-serialising JSON changes spacing and key order. Check whether the provider includes a timestamp prefix (Stripe signs timestamp.body), and whether the expected output is hex or Base64.
HMAC-SHA variants are computed with your browser's Web Crypto API and HMAC-MD5 in JavaScript on this page. Your key and message never leave your device.
FAQ
Which HMAC algorithm should I use?
HMAC-SHA256 is the standard choice for new systems. HMAC-SHA1 is still secure but older; HMAC-MD5 should only be used for legacy compatibility.
Why does my webhook signature not match?
You probably hashed a modified body. Use the exact raw bytes received, include any timestamp prefix the provider specifies, and compare in the same encoding.
Is the key length important?
Use a random key at least as long as the hash output, such as 32 bytes for SHA-256. Short or guessable keys can be brute-forced.