HMAC Generator (SHA-1 / 256 / 384 / 512)
Developer
Generate HMAC signatures for a message and key using SHA-1, SHA-256, SHA-384, or SHA-512. Keys can be UTF-8, Base64, or Hex encoded — useful when the secret was stored in a different format. Output is hex or Base64. All computation uses `crypto.subtle.sign` in your browser; nothing is sent anywhere. Commonly used to verify Stripe, GitHub, Shopify, and Slack webhook signatures.
Enter a message and key.
How to use
- Paste the message and the key.
- Pick key encoding (UTF-8 is most common; Stripe uses UTF-8, GitHub uses UTF-8, AWS SigV4 uses derived hex keys).
- Choose algorithm and output format — the result updates live.
Frequently asked questions
- Which algorithm should I use?
- HMAC-SHA256 is the modern default — used by Stripe, GitHub, Shopify, AWS SigV4. Avoid SHA-1 for new code (though it's still safe against HMAC attacks; just not future-proof).
- Why are key encodings needed?
- Some APIs give you the secret as a Base64 or Hex string. Treating those as UTF-8 produces a different signature than the server computes. Match the encoding of the published secret.
- Is hex vs Base64 output meaningful?
- Each API expects one — GitHub wants hex prefixed with `sha256=`, Stripe wants hex too, Slack wants hex, AWS uses hex. Base64 shows up in some custom protocols.
- Can this verify a signature?
- Indirectly — compute the HMAC of the message/key, then compare to the expected signature. For safety, do that comparison in constant time (which a browser's `===` is not).
Related tools
JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
UUID Generator
Generate random version-4 UUIDs in bulk, with copy.
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
URL Encoder / Decoder
Percent-encode text for URLs, or decode encoded URLs back to text.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to text, instantly.
JSON Formatter & Validator
Format, beautify, minify, and validate JSON right in your browser.