Home HMAC generator

HMAC generator

Enter a key and a message to get an HMAC. The key can be text, hex, or Base64, and the result can be compared with a signature you already have.

Signature

Why this exists

A webhook or API signature matches only when the key and the body have the same bytes. One line break or one extra space changes the value completely.

Paste a hex or Base64 signature you already have and see at once whether it matches the one just calculated.

  1. 01How to use it

    Enter the message and the key. Choose the algorithm, the output, and the line ending, and the signature appears.

    Paste a signature you already have into Compare. It shows whether the values match. All algorithms lists the seven signatures together.

  2. 02What you get

    The example uses the text key my-secret-key-123 and a greeting. The default output is lowercase hex.

    A line break, a trailing newline, a BOM, or surrounding spaces are mentioned under the signature.

    EnteredGreeting

    Algorithm SHA-256
    Key text my-secret-key-123
    Output hex

  3. 03Worth knowing

    An empty key is not signed. A hex key must be an even run of 0-9 and a-f, and Base64 must decode.

    SHA-256 is the hash APIs use most. Choose MD5 or SHA-1 only when an older system still requires it.

Questions

QDo the key and the message leave the browser?
ANo. The signature is calculated on the page, and the input is not stored.
QCan I compare hex and Base64 together?
AYes. Compare accepts lowercase or uppercase hex and the Base64 form, whatever the output setting is.
QWhy does the line ending change the value?
ALF and CRLF are different bytes. Choose CRLF when the other side signed with Windows line breaks.
QWhich algorithm should I pick?
ANew APIs default to SHA-256. Pick the name written in the documentation you are matching.

How this page works it out

This page builds an HMAC with SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, MD5, or RIPEMD-160.

The key may be text, hex, or base64, and the signature is shown as hex and as base64. The message line ending can be LF or CRLF.

A compare box checks a signature you already have. An empty key, odd-length hex, bad hex, and bad base64 are errors. DES, RC2, and MD4 are not offered.

The secret and the message stay in this browser while the signature is computed. The key is not sent to a signing server.

  • # hmac
  • # sha256
  • # signature
  • # webhook