HMAC Generator

What this tool does

HMAC Generator computes RFC 2104 keyed hashes over text, raw bytes or whole files with 20 hash functions. Enter the shared secret as text, hex or Base64, add a webhook prefix such as sha256= and paste a received signature to check it matches.

An HMAC proves that a message came from someone who knows a shared secret and was not altered on the way. Payment providers, GitHub, Slack and most webhook senders sign each request body with HMAC-SHA256, and many REST APIs sign requests the same way. When a signature check fails you need to recompute the value yourself to see whether the body, the key or the encoding is wrong.

This tool implements HMAC as defined in RFC 2104: the key is padded to the hash block size (64 bytes for SHA-256, 128 for SHA-512, hashed first if longer), XORed with the inner and outer pads, and the message is hashed twice. It supports MD5, SHA-1, the SHA-2 and SHA-3 families, Keccak, BLAKE2, RIPEMD-160, Whirlpool and SM3 through WebAssembly. Keys and messages can be UTF-8, hex or Base64, files are streamed, and everything runs locally so secrets never leave the page.

How to use HMAC Generator

1. Choose Text or File as the message source.
2. Enter the Secret key, or click Random key to create a 256-bit key in hex.
3. Set “Key is” and “Message is” to match how your values are encoded.
4. Pick the Hash function, for example HMAC-SHA-256.
5. Choose the Output format and, for webhooks, a Signature prefix such as sha256=.
6. Paste a received value into “Verify against signature” to see Match or Does not match, then copy the result.

Tips for better results

• RFC 4231 test case 2 is a quick self-check: key “Jefe” and message “what do ya want for nothing?” give HMAC-SHA-256 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.
• GitHub sends X-Hub-Signature-256 as sha256= followed by lowercase hex of the raw body, signed with your webhook secret.
• Slack signs the string v0:timestamp:body, so paste that exact basestring as the message, not just the body.
• Keys from dashboards are often hex or Base64 encoded. Treating them as plain text is the most common cause of a mismatch.

Common use cases

• Debugging a webhook endpoint that rejects valid-looking requests.
• Creating signed test requests for an API that uses HMAC authentication.
• Checking an HMAC implementation against known test vectors.
• Computing a keyed checksum of a file so only holders of the key can produce it.

Common mistakes to avoid

• Signing a re-formatted body. Parsing and re-serialising JSON changes spacing or key order and therefore the signature.
• Mixing up hex and Base64 output when comparing with a header value.
• Comparing signatures in production code with ordinary string equality instead of a constant-time comparison, which can leak timing information.