HMAC Generator
Keyed hashes for API signatures (SHA-1…512).
HMAC provides message authentication — used for API signatures (e.g. AWS, Stripe webhooks).
About the HMAC Generator
Generate keyed HMAC signatures for verifying API requests and webhooks, with SHA-1, SHA-256, SHA-384 or SHA-512 via the Web Crypto API. The signature appears in hex and Base64 since different providers expect different encodings — Stripe, AWS and most webhook validators accept one or the other.
How to use the HMAC Generator
- Choose the hash algorithm your provider specifies, SHA-256 by default.
- Paste the shared secret key into the Secret key field.
- Paste the exact message payload into the editor.
- Copy the HMAC in hex, or the Base64 variant beneath it.
HMAC Generator FAQ
Why do I get two encodings?
Hex is the traditional digest form, but many webhook systems sign or compare Base64 strings — producing both removes the encoding guesswork when matching a provider's expected signature.
What is an HMAC for?
It proves that a message came from someone holding the shared secret and was not modified in transit, which is how services like AWS and Stripe authenticate webhook calls.
Is my secret key safe here?
The signature is computed in your browser with Web Crypto and nothing is transmitted, but paste test keys where possible since shared secrets should be treated as credentials.