AZ Tools

HMAC Generator (SHA-1 / 256 / 384 / 512)

Developer

Generate HMAC signatures for a message and key using SHA-1, SHA-256, SHA-384, or SHA-512. Keys can be UTF-8, Base64, or Hex encoded — useful when the secret was stored in a different format. Output is hex or Base64. All computation uses `crypto.subtle.sign` in your browser; nothing is sent anywhere. Commonly used to verify Stripe, GitHub, Shopify, and Slack webhook signatures.

Signature

Enter a message and key.

How to use

  1. Paste the message and the key.
  2. Pick key encoding (UTF-8 is most common; Stripe uses UTF-8, GitHub uses UTF-8, AWS SigV4 uses derived hex keys).
  3. Choose algorithm and output format — the result updates live.

Frequently asked questions

Which algorithm should I use?
HMAC-SHA256 is the modern default — used by Stripe, GitHub, Shopify, AWS SigV4. Avoid SHA-1 for new code (though it's still safe against HMAC attacks; just not future-proof).
Why are key encodings needed?
Some APIs give you the secret as a Base64 or Hex string. Treating those as UTF-8 produces a different signature than the server computes. Match the encoding of the published secret.
Is hex vs Base64 output meaningful?
Each API expects one — GitHub wants hex prefixed with `sha256=`, Stripe wants hex too, Slack wants hex, AWS uses hex. Base64 shows up in some custom protocols.
Can this verify a signature?
Indirectly — compute the HMAC of the message/key, then compare to the expected signature. For safety, do that comparison in constant time (which a browser's `===` is not).

Related tools