HMAC Generator

How to use the hmac generator

1. Enter the secret key and choose an algorithm.
2. Paste the exact message payload.
3. Copy the hex or Base64 signature.

About this tool

HMAC combines a message with a secret key to produce a signature that proves two things at once: the message came from someone holding the key, and it has not been altered in transit. It is what webhook providers use to let you verify that a callback genuinely came from them.

The most common reason a signature will not match is not the key — it is the payload. Whitespace, line endings and the exact JSON serialisation are all part of the signed message, so sign the raw body bytes rather than a re-serialised object.

Use a test secret here. The signing happens in this page and nothing is transmitted, but a production webhook key should not be pasted into any website, including this one.

Common uses

• Reproducing a webhook signature while debugging.
• Checking an API request signing implementation.
• Generating a signed value for a test.

Frequently asked questions

Why does my signature not match the provider's?

Almost always the payload rather than the key. Sign the exact raw bytes received, including whitespace and line endings — re-serialising JSON changes them.

Hex or Base64?

Whichever your provider specifies; both encode the same bytes. GitHub uses hex, several others use Base64.