Skip to content
ToolQivo

HMAC Generator

Generate HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512.

Developer Tools Reviews Free · no sign-up

A webhook signature covers the exact request body. Re-serialising JSON before hashing changes the bytes and breaks the signature — sign the raw body.

Quick Tool Overview

The HMAC Generator signs a message with a shared secret using SHA-1, SHA-256, SHA-384 or SHA-512, outputs hex or Base64, and compares against a signature you received — which is how you debug a webhook.

What it does
Computes and verifies HMAC signatures
You give it
A message and a shared secret
You get back
The signature in hex and Base64
Best for
Verifying webhooks from Stripe, GitHub, Shopify and Slack
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the HMAC Generator

An HMAC proves two things at once: that a message has not been altered, and that it came from someone holding the shared secret. That is why every webhook worth trusting is signed with one — Stripe, GitHub, Shopify and Slack all use HMAC-SHA256.

Paste the payload and the secret and you get the signature in hex or Base64, which is the two forms providers actually send. Verifying an incoming webhook is the usual reason to be here: paste the raw body and your signing secret, compare with the header you received, and the tool tells you whether they match. The secret is used inside your browser and never transmitted, but a secret pasted into any web tool is worth rotating afterwards.

Key features of the HMAC Generator

Signature comparison

Paste the signature header you received and the tool says whether it matches, which is the actual question when a webhook is being rejected.

Both output formats

Hex and Base64 side by side, because providers disagree about which they send.

Secrets in three forms

Enter the key as text, hex or Base64 — several providers hand out a Base64 secret that must be decoded before use.

Exact-byte hashing

The message is hashed exactly as pasted, which matters because re-serialising a JSON body is the single most common cause of a signature mismatch.

Uses the browser’s crypto

HMAC comes from SubtleCrypto rather than a JavaScript reimplementation, and the secret never leaves the tab.

How to use the HMAC Generator

  1. 1

    Paste the message

    The exact bytes that were signed — for a webhook, the raw request body before any parsing.

  2. 2

    Enter the secret

    The shared signing key, as text or as hex or Base64 bytes.

  3. 3

    Choose the algorithm

    SHA-256 unless the provider documents otherwise.

  4. 4

    Compare the signature

    Paste the signature you received and the tool confirms whether it matches.

Frequently asked questions

Almost always because the body was re-serialised before hashing. An HMAC covers exact bytes, so parsing JSON and re-encoding it changes key order or whitespace and breaks the signature. Sign the raw body.

Reviews of the HMAC Generator

What people who use the HMAC Generator think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the HMAC Generator. It takes half a minute and no account.

Write the first review

More developer tools