Security
HMAC Generator
Compute HMAC signatures of a message with a secret key to test webhooks and API authentication.
- Runs in your browser
- Instant results
- Free, no sign-up
Loading the tool…
How to use the HMAC Generator
- Paste the message, such as a webhook body.
- Enter the secret key and its format.
- Compare the signatures with the one you received.
Frequently asked questions
What is HMAC?
A signature made from a message and a secret key. Only someone with the key can produce or check it.
Why doesn't my webhook signature match?
The body must be byte-for-byte identical, including whitespace, and some services sign a timestamp too.
Is SHA-1 HMAC still safe?
HMAC-SHA1 is still considered secure, but prefer HMAC-SHA256 for new systems.