HMAC generator — sign payloads for webhooks
Compute an HMAC signature over a message with a secret key, in SHA-1 through SHA-512. It signs in your browser (0 uploads, works offline), so the secret never leaves your device.
How to use it
- Enter your input above.
- The result appears instantly on your device.
- Copy or Download it.
FAQ
How do I generate an HMAC signature for free?
Enter the message and the secret key, pick an algorithm, and the HMAC appears instantly in hex and Base64, computed by your browser's Web Crypto with no upload — the standard way to verify webhook payloads from Stripe, GitHub and others.
What is HMAC used for?
Verifying that a message came from someone who holds the shared secret and was not tampered with — the mechanism behind webhook signatures. The receiver recomputes the HMAC and compares, so a forged payload fails.
Is my secret uploaded?
No. Signing happens locally via Web Crypto; the key is never transmitted or stored — which is the only safe way to handle a signing secret, and it works offline.
Which algorithm should I use?
Match what the service specifies — usually HMAC-SHA256. The signature must be computed with the same algorithm the verifier uses.
Limits
Signs text messages. Hashing files is a separate tool. SHA-1 HMAC is offered for legacy compatibility only.
Related
The hash generator produces plain digests; basic auth builds an Authorization header.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.