HMAC Generator

An HMAC proves that a message comes from a sender who holds the secret key, and that nobody changed the message. It combines the message and the key with a hash.

A webhook uses an HMAC. The sender puts the signature in a header. Your server computes the same HMAC over the raw body and compares the two values. Compare them with a constant-time function, never with a plain equals.

Paste the signature of the sender into "Expected signature" to check it. The tool accepts hex or Base64, in upper case or lower case, and it removes a prefix such as sha256=. It compares the bytes with a constant-time check, so the run time does not leak where the first difference is.

A key is bytes, not text. Select the key format that matches your key. "Text (UTF-8)" reads the key as UTF-8 text. "Hex" and "Base64" decode the key to the same bytes that the sender uses. The tool reports an error when the key holds a character that the selected format does not allow.

The tool converts the message to bytes with UTF-8 and shows the exact byte count. It does not trim the message and it does not change the whitespace, because one extra space changes the signature. A character outside the ASCII range needs more than one byte, so the byte count and the character count can differ.

An HMAC is not encryption. It does not hide the message. Anybody can read the message; only a holder of the key can make a valid signature.