An HMAC combines a message with a secret key to produce a signature that proves two things: the message hasn't changed and the sender knows the key. Web APIs and webhooks use them constantly. This tool supports SHA-1, SHA-256, SHA-384 and SHA-512 and gives the result in hex and Base64.
How to use it
- Enter the message.
- Enter the secret key.
- Choose the algorithm.
- Copy the hex or Base64 result.
When it helps
- Checking webhook signatures.
- Signing API requests.
- Working out why two signatures don't match.
- Learning message authentication.
Good to know
- The key and message must match byte for byte, including whitespace and encoding.
- Prefer SHA-256 or stronger.
- Don't paste real production keys on a shared computer.
How an HMAC is calculated
HMAC mixes a secret key into a hash in two rounds: the key is combined with the message and hashed, and then combined with the first result and hashed again. This construction resists attacks that affect simple key-plus-message hashing.
The output length matches the hash: 64 hex characters for SHA-256.
Worked example: verifying a webhook
A service signs each webhook with HMAC-SHA256 using a shared secret and sends the result in a header. To check, compute the HMAC of the raw request body with your copy of the secret and compare. If they match, the sender knows the secret and the body wasn't changed.
Compare in constant time in your code, and reject requests with old timestamps to stop replays.
Choosing algorithm and key
Use SHA-256 or stronger. SHA-1 HMACs are still considered secure in practice but are being phased out. Keys should be at least as long as the hash output, randomly generated, and stored in a secrets manager.
Rotate keys when staff leave or if a leak is possible.
Common mistakes
Signing the parsed or re-encoded body instead of the raw bytes is a frequent cause of mismatches, as is using the wrong encoding for the key. Check whether the key is meant to be used as text or decoded from hex or Base64.
Never put secret keys in front-end code, where anyone can read them.
Testing against known vectors
Check your understanding with a published example: the key key and the message The quick brown fox jumps over the lazy dog give an HMAC-SHA256 of f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. If you get that, your setup is right.
Standards documents publish more vectors for each algorithm.
HMAC in everyday services
Payment providers, chat platforms and code hosts all sign webhook calls with an HMAC. Knowing how to reproduce one by hand means you can debug a failing integration step by step, instead of guessing why a signature is rejected.
Questions
What's the difference between a hash and an HMAC?
An HMAC uses a secret key, so only someone with the key can make a valid one.
Why doesn't my signature match?
Look for hidden whitespace, different encoding and the wrong algorithm.