Hmac generator

About Hmac generator

Compute an HMAC of a message with a secret key using MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 (FIPS 202), Keccak-256 or RIPEMD-160. The key can be entered as UTF-8 text, hex or Base64, and the output can be hex (optionally uppercase), Base64 or URL-safe Base64. It runs in your browser, so the secret key is not sent anywhere.

Common uses

• Reproduce a webhook signature (for example HMAC-SHA256 of the raw body) to debug verification.
• Sign a test API request that requires an HMAC header.
• Check that your server code computes the same HMAC as a reference value.
• Convert an HMAC between hex and Base64 representations.

FAQ

What is the difference between a hash and an HMAC?

A hash depends only on the message, so anyone can compute it. An HMAC also mixes in a secret key, so only parties who know the key can produce or verify it, which proves the message was not altered and came from a key holder.

Why doesn't my webhook signature match?

Common causes are hashing a re-serialized JSON body instead of the exact raw bytes, using the wrong key encoding (text vs hex vs Base64), comparing hex to Base64 output, or omitting a timestamp or prefix that the provider includes in the signed string.

Is HMAC-MD5 or HMAC-SHA1 still secure?

HMAC's security does not rely on collision resistance, so HMAC-SHA1 and even HMAC-MD5 are not broken in the way plain MD5 and SHA-1 are. HMAC-SHA256 is still the recommended choice for new systems.