HMAC Generator
Sign text with a secret key: HMAC-SHA256, SHA-512, SHA-1 or MD5.
Questions
What's the difference between HMAC and a plain hash?
Anyone can compute a plain hash of a message. An HMAC also needs a secret key, so a matching HMAC proves the message came from someone with the key and wasn't changed.
Which algorithm should I use?
HMAC-SHA256 for anything new. SHA-1 and MD5 are here because some older APIs still require them. HMAC-MD5 has no known practical attack (RFC 6151), but don't choose it for new work.
Why is an empty key an error?
An HMAC with no key proves nothing, and a blank key is almost always a mistake.
How do I check a webhook signature?
Paste the raw request body as the message, enter the webhook secret as the key and pick the algorithm the provider uses. Compare the result with the signature header. Any change to the body, even whitespace, changes the result.
Is my key sent anywhere?
No. Everything runs in your browser. This tool has no Share button, because a link would carry your key.