HMAC-SHA1, SHA-256, SHA-384 and SHA-512 of text or a file, and signature checks
Runs in your browser. Nothing you type is sent anywhere. Updated on 24 Oct 2026.An HMAC proves a message came from someone holding the shared secret, which is how a webhook is verified. SHA-1, SHA-256, SHA-384 and SHA-512 are supported, on text or on a file up to 200 MB. The secret never leaves your browser, which matters for a signing key.
Pick SHA-1, SHA-256, SHA-384 or SHA-512 under Algorithm.
Enter the Secret key and set whether it is written as Text, Hex or Base64.
Paste the message under Text, or switch to File and press Choose a file.
Copy the Hex, Base64 or Base64URL result with its copy icon; Ctrl+Enter copies the hex.
This HMAC generator computes a keyed hash of text or a file with SHA-1, SHA-256, SHA-384 or SHA-512 and shows the result in hex, Base64 and URL-safe Base64 as you type. It also verifies: paste the signature you expect and it tells you whether it matches.
HMAC is how two systems prove a message came from someone holding a shared secret and was not changed on the way. Developers reach for it when a payment provider's webhook fails verification and they need to know whether the secret, the body or the header is wrong, when writing a signing function and checking it against a known answer, or when an API document shows an example signature to reproduce.
The key can be typed as text, hex or Base64, because providers publish secrets in all three. The expected signature can be hex or Base64 and may keep its header prefix, such as sha256= from GitHub or the t=,v1= format from Stripe. Comparison runs in constant time, the way your server should do it too.
Everything happens in your browser through the Web Crypto API. The key and message are never uploaded, logged or saved, not even in this browser; only the algorithm and key format you chose are remembered. Files up to 200 MB can be signed, since the whole file has to be in memory at once.
When a webhook check fails, the usual cause is the body: the signature covers the exact raw bytes, and a JSON body re-serialised by a framework will not match. Related tools: JWT Decoder, Base64 Encoder, Bcrypt Hash and Verify.
Choose SHA-256, type or paste the secret key, then type the message or pick a file. The signature appears immediately in hex and Base64; press Copy next to the one your API expects. If your key is given as hex or Base64 rather than text, switch the key format first, because the same characters decode to different bytes.
No. The HMAC is computed in your browser with the Web Crypto API, and the key and message never leave the page. Nothing you type is logged or saved, not even in local storage. Only the algorithm and key format you chose are remembered on this device for next time.
Usually the body is not byte-for-byte what the sender signed: a framework parsed and re-serialised the JSON, changed line endings or trimmed whitespace. Sign the raw body. Other causes are using the wrong secret (test and live keys differ), treating a hex secret as text, or comparing hex against a Base64 signature.
A plain hash can be computed by anyone, so it proves nothing about who made it. HMAC mixes in a secret key, so only someone with the key can produce the right value. It is also built to resist length-extension attacks that break the naive approach of hashing the key followed by the message.
An ordinary string comparison stops at the first different character, so how long it takes reveals how much of a guessed signature was right. Measured over many requests, that lets an attacker build a valid signature one byte at a time. This tool compares every byte every time, and your server code should too.
Text messages of any practical length and files up to 200 MB, because Web Crypto needs the whole message in memory. SHA-1, SHA-256, SHA-384 and SHA-512 are supported; MD5 is not available in Web Crypto and should not be used for new signatures anyway. Keys must be at least one byte.
Still stuck? Ask about HMAC Generator and anybody who knows can answer. No account needed.
Same job, other tools: Bcrypt Generator – Generate a bcrypt hash for a test user or a config file · OTP Generator – Time-based one-time passwords with 6 or 8 digits and a choice of algorithm.
On the related tools: JWT Decoder – Paste a token to read its header, payload and expiry.
In the collection Security Tools for Developers.