HMAC Generator & Verifier
Create and check HMAC-SHA256 and other HMAC signatures with a secret key.
Optional. A GitHub X-Hub-Signature-256 header value (sha256=…) can be pasted as it is.
An HMAC is a signature made from a message and a shared secret key: anyone with the key can compute it again, and any change to the message or the key gives a different value. Webhooks (GitHub, Stripe, Slack), signed API requests and JWT HS256 tokens all use it. The HMAC updates as you type, and you can paste a signature to check it. It is computed by your browser's built-in Web Crypto, so the message and the key never leave your device; it's free and needs no sign-up.
How to generate and verify an HMAC
- Paste the message exactly as it was signed — for a webhook, the raw request body.
- Enter the secret key, or click Generate for a random one; choose Hex if you were given the key as hex bytes.
- Pick the algorithm (SHA-256 unless told otherwise) and copy the result as hex or Base64.
- To check a signature, paste it under Check a signature — a GitHub sha256=… header value works as it is.
Features
- HMAC-SHA1, HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512
- Secret key as text (UTF-8) or hex, or a random 32-byte key from Generate
- Result in hex or Base64, updated as you type
- Checks a received signature in hex or Base64 (URL-safe too), with or without GitHub's sha256= or Slack's v0= prefix
- Tells you when a signature has another algorithm's length, with a button to switch
- Computed with your browser's built-in Web Crypto
Is it private?
Yes. The HMAC is computed by your browser's built-in Web Crypto; the message and the secret key stay on this page and are never uploaded or saved.
Frequently asked questions
How do I verify a GitHub webhook signature?
Paste the raw request body as the message, your webhook secret as a text key, and the X-Hub-Signature-256 header value under Check a signature. GitHub sends sha256= followed by the hex HMAC-SHA256 of the body, and the prefix is read as it is.
How do I check a JWT HS256 signature?
Paste the token's header and payload — everything before the second dot — as the message, the secret as the key, choose SHA-256, and paste the third part of the token under Check a signature. Its URL-safe Base64 is read as it is.
Why doesn't my signature match?
The message must be byte for byte what was signed: reformatted JSON, a missing or extra line break at the end, or Windows (CRLF) line endings all change the HMAC. Text typed here uses LF line breaks. Also check the algorithm and whether the key is text or hex.
Does it give the same result as OpenSSL?
Yes. printf '%s' 'message' | openssl dgst -sha256 -hmac 'key' prints the same hex value, and a hex key matches -mac HMAC -macopt hexkey:…. Use printf or echo -n: plain echo adds a line break that is signed too.
Is HMAC-SHA1 still safe to use?
For HMAC, yes in practice: the known SHA-1 collisions don't break HMAC-SHA1, which is why older webhooks still use it. For anything new, choose HMAC-SHA256.