HMAC Generator
Compute an HMAC signature for a message and key, in hex or base64, and compare it against a signature you received.
Compare with a received signature
Files are processed in your browser and are never uploaded to a server.
How to use
Free to use with no sign-up, no install and no usage limit.
Paste the message and the key, choose a hash, and the signature appears. Paste a signature you received into the compare box and it tells you whether the two match.
This is the calculation behind webhook verification. Stripe, GitHub and most payment providers sign the request body with a shared secret and put the result in a header; your endpoint recomputes it and rejects anything that does not match.
It is not the same as a plain hash. Anyone can compute SHA-256 of an altered body and send the new hash along with it. An HMAC can only be produced by someone who holds the key, which is what makes it proof of origin.
Keys are often distributed as hex or base64 rather than text, so the encoding of the key is a separate choice. Reading a hex key as text gives a completely different signature — a common cause of verification failing when the code looks right.
The comparison always scans the full string. Stopping at the first difference would make the time taken reveal how many leading characters were correct, and an attacker can walk a signature out one character at a time from that. Your server should compare the same way.
SHA-1 is offered because older systems still require it, but do not choose it for anything new.
Nothing you paste is sent to a server. The signature is computed inside your browser with the Web Crypto API.