01
Start with the original payload
Do not pretty-print JSON or trim the request body. A newline, BOM or different Unicode representation can change the signed bytes.
- Use Hex or Base64 when text controls cannot preserve the original bytes.
Hash & Crypto Helpers
HMAC generatorGenerate and verify exact bytes
Choose encodings for the message and key. Generate a digest or verify an expected value independently.
HMAC generator
Message
HMAC digest
Message and key stay in this page’s memory; nothing is uploaded or saved to browser storage.
Options
No trimming or normalization. For multiline keys use Hex/Base64. Verify accepts the full digest without a header prefix.
Message: 1,000,000 UTF-16 units and bytes. Key: 4,096 UTF-16 units; nonempty.
Enter a key, then generate or verify. An empty message is allowed.
HMAC generator helps diagnose a webhook or API signature that differs between systems. Keep the original message intact and check the key representation before changing the algorithm.
Use the HMAC SHA256 default for a matching integration, or choose SHA-512 or SHA-1 when the protocol requires it. This HMAC calculator checks a message authentication code; it does not encrypt the message.
Why use this HMAC generator?
Text and encoded keys are different
HMAC generator separates message encoding from key encoding. The characters 6162 in a text key are four bytes; Hex 6162 decodes to two. An identical-looking secret can therefore produce a different digest.
Verify a complete reference
As an HMAC verifier, this tool distinguishes malformed input from a valid signature that does not match. Verification uses the current message, secret and algorithm, even when you have not generated a result first.
Match the signing contract
02
Set the key format separately
Choose UTF-8 for literal text, Hex for byte pairs, or standard Base64 for an encoded key. The masked key field is single-line.
- The single-line key field rejects pasted or dropped line breaks without changing your key. Encode a multiline key as Hex or Base64 first.
03
Choose generation or verification
Generate computes a digest; Verify also checks the expected digest using its own encoding selector. Both run only when requested.
- Ctrl/Cmd + Enter verifies in the expected digest field and generates elsewhere. Repeated shortcuts during calculation are ignored.
Generation and verification controls
Three specified algorithms
SHA-256 produces 32 bytes, SHA-512 produces 64, and SHA-1 produces 20. Match the algorithm named by the receiving system; the SHA-1 option is for legacy compatibility.
Independent representations
Message and key each accept UTF-8, Hex or standard Base64. Output and reference can use different encodings: uppercase Hex and lowercase Hex describe the same bytes; Base64 is case-sensitive.
Native signature verification
The browser Web Crypto API performs HMAC signing and verification. A match checks the supplied bytes and key. It does not validate a webhook timestamp, identify a sender independently, or prevent replay.
Byte rules and scope
- Exact input, strict decoding
- No trimming, JSON reserialization or Unicode normalization occurs. Hex rejects prefixes, separators, whitespace and odd lengths. Base64 rejects URL-safe symbols, whitespace, incorrect padding and noncanonical unused bits; correct omitted padding is accepted.
- Empty message, nonempty key
- An empty message is valid; an empty decoded secret is rejected. Message input is capped at 1,000,000 UTF-16 units and decoded message data at 1,000,000 bytes. Key input is capped at 4,096 UTF-16 units.
- Full digests only
- Reference values must decode to exactly 20, 32 or 64 bytes for the selected algorithm. Remove protocol wrappers such as sha256= yourself. Truncated digests, automatic algorithm detection, file input and URL fetching are outside this page.
- Session state and undo
- Changing inputs invalidates old output. Example and Clear show replacement counts before applying and retain one in-memory undo snapshot, including the key. A later input edit discards that snapshot. No key generation, password storage or downloadable secret report is provided.
HMAC generator questions
Which algorithm should I choose?
Match the algorithm in your integration documentation. SHA-256 is selected initially. SHA-512 and SHA-1 are available for compatibility with specified protocols; changing the algorithm changes both the digest and its expected length.
Is it safe to paste my secret key here?
The HMAC generator computes locally and does not send the message or key to a server or store them in browser storage. Clear retains one undo snapshot until another edit; leaving the page removes application references. JavaScript cannot promise forensic memory erasure.
Base64 or Hex?
They are representations of the same digest bytes. Select the format used by the reference value. A SHA-256 digest has 64 Hex characters or 44 standard Base64 characters including padding. Output format and expected format are separate options.
What character encoding is used (UTF-8)?
UTF-8 encodes literal characters without normalizing Unicode. Hex and Base64 first decode to bytes. Browser paste behavior may alter line endings, so use encoded bytes when the exact original payload matters.
Why does my signature not match the one in the header?
Check the raw body, secret encoding and algorithm first. Extract the digest from the header and build the signed string exactly as the provider specifies. This page does not assemble timestamps, strip signature prefixes or enforce expiry.
Still have a question?
Try a known signature
Use HMAC generator with the RFC example, verify its reference, then change one message character and observe the mismatch.
Choose encodings for the message and key. Generate a digest or verify an expected value independently.