ToolDeck

HMAC generator

Compute an HMAC-SHA256 (or SHA-1, SHA-384, SHA-512) signature for a message and key.

Runs in your browser. Your input is not uploaded.

 

What it does

An HMAC combines a secret key with a message to produce a signature only someone with the key can create. Stripe, GitHub, Slack and most webhook providers sign their requests this way, usually with HMAC-SHA256.

The calculation uses Web Crypto. The key and message can be text, hex or Base64.

How to use it

  1. Paste the message: for webhooks, the raw request body exactly as received.
  2. Enter the secret key and choose its encoding.
  3. Compare the result with the signature header.

Example: HMAC-SHA256, key "key"

Input
abc
Output
9c196e32dc0175f86f4b1cb89289d6619de6bee699e4c378e68309ed97a1a6ab

Things to watch for

  • Webhook signatures are calculated over the raw bytes. Re-serialised JSON, even with the same content, gives a different HMAC.
  • Some providers sign a string that includes a timestamp, such as Stripe’s t=… scheme. Build that string first.
  • In server code, compare signatures with a constant-time function such as crypto.timingSafeEqual.

Questions

How do I verify a GitHub webhook?
Compute HMAC-SHA256 of the raw body with your webhook secret, in hex. It should equal the X-Hub-Signature-256 header after the sha256= prefix.
Is HMAC encryption?
No. The message is not hidden. HMAC proves the message came from someone with the key and was not changed.
Is the secret key uploaded?
No. It is used by Web Crypto in this page only.
Is HMAC-SHA1 still safe?
Yes for HMAC, although SHA-256 is preferred for new systems.