HMAC Generator & Validator

Compute an HMAC signature for a message and secret, or verify one you received matches.

Message

Secret key

Algorithm

Output encoding

Compare against (optional)

Was this tool useful?

About this tool

An HMAC proves a message came from someone who knows a shared secret, and wasn't altered in transit — the mechanism behind webhook signature verification (Stripe, GitHub and most others sign their payloads this way). Computed via the browser's own Web Crypto API, not a hand-rolled hash.

How to use it

Enter the message and the shared secret, pick an algorithm and output encoding.
Press Generate to compute the HMAC.
To verify a signature you received, paste it into the compare field — a match/mismatch is shown against the value you just computed.

Examples

Verifying a webhook signature

Message: the raw request body · Secret: your webhook signing secret · Compare: the "X-Signature" header value

A match confirms the payload is genuine and unmodified; a mismatch means it isn't (or the wrong secret/algorithm was used).

Common problems

My computed HMAC never matches the one the service sent.: Check that the message is the exact raw bytes that were signed (not a re-serialized or pretty-printed version of a JSON body — even different whitespace produces a completely different HMAC) and that the algorithm matches what the sender documents.