About this tool
An HMAC proves that a message came from someone who knows a shared secret and has not been tampered with — the mechanism behind signed webhooks, API request signing and many token schemes. Enter your message and secret key, choose SHA-256, SHA-384 or SHA-512, and get the signature as hexadecimal or Base64.
The computation uses the browser’s native Web Crypto API and happens entirely on your device, so your secret key is never transmitted. It updates live as you type.
Frequently asked questions
What is HMAC used for?
HMAC (Hash-based Message Authentication Code) proves both that a message wasn't altered and that it came from someone who knows a shared secret key — it's how services like Stripe or GitHub sign webhook payloads so you can verify authenticity.
Is HMAC the same as just hashing the message?
No. A plain hash (SHA-256 of the message alone) can be recomputed by anyone, so it proves nothing about origin. HMAC mixes in a secret key using a construction that resists length-extension attacks, so only someone holding the key can produce a valid signature.
Does my secret key get sent anywhere?
No. The HMAC is computed locally with the browser's Web Crypto API (crypto.subtle). Your key and message never leave your device.
Why does the signature verification say "no match" even though I copied it correctly?
Webhook headers are often prefixed like sha256=<hex>, use a different case, or have surrounding whitespace. The verifier normalizes case and strips an algorithm= prefix automatically, but double-check you picked the same hash algorithm and key encoding (UTF-8/Hex/Base64) the sender used.
What key encoding should I choose?
Most APIs give you a plain UTF-8 secret string (e.g., whsec_...) — use UTF-8. Choose Hex or Base64 only if the provider's documentation explicitly says the key is encoded that way.