HMAC generator

Sign a message with a secret key, or check a webhook signature. Runs in this browser — the key is never sent anywhere.

1 · Message

Message to sign

2 · Key and algorithm

Secret key

Prefer a test key over a production one while experimenting.

Hash

3 · Signature

Hex

Base64

Compare against the signature you received (optional)

If a webhook signature will not match, the cause is almost always that the body was parsed and re-serialised before signing. Capture the raw body first. Also check the timestamp: a valid signature on a replayed old request is still valid. MD5 is not offered here, because an HMAC is a security control and a weak option with nothing marking it weak is a trap.

What an HMAC proves

A plain hash tells you a message has not changed. It cannot tell you who sent it, because anyone can compute a hash. An HMAC mixes a shared secret key into the hash, so a matching value proves the message came from somebody who holds the key and has not been altered on the way.

Where you meet one

Almost every webhook. Stripe, GitHub, Razorpay, Slack and Twilio all sign their callbacks with an HMAC and put it in a header. Verifying that signature is what stops anyone who learns your endpoint URL from posting fake events to it. This tool is for checking your implementation against a known-good value when that verification fails.

Getting it right

Sign the raw body. Parsing JSON and re-serialising it changes the bytes, and the signature will never match. Capture the body before any middleware touches it.
Compare in constant time. A plain string comparison returns early on the first differing character, which leaks the position of the difference. Use the comparison your platform provides for this.
Check the timestamp too. A valid signature on a replayed old request is still a valid signature.

Why MD5 is not offered here

An HMAC is a security control by definition. Offering HMAC-MD5 in a builder would hand somebody a weak option with nothing to tell them it was weak, so only the SHA family is available.

Example

HMAC-SHA256 with the key Jefe over the message what do ya want for nothing? is 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843. That is test case 2 from RFC 4231, so you can verify this tool against the standard.