HMAC Generator & Verifier
Compute an HMAC of a message with a secret key, or check that a signature (webhook, API request) is valid. The key and message stay in your browser.
Runs in your browser — nothing is uploaded.
Hidden while you type. An empty key is not allowed.
HMAC
CopiedVerify a signature
Hex or base64 / base64url, detected automatically.
How to use it
- Enter the message and the secret key, and say whether the key is text, hex or base64.
- Choose the algorithm and the output format. The HMAC appears as you type.
- To check a signature you received, paste it in “Expected HMAC”: the page says whether it is valid.
Frequently asked questions
Is my key sent anywhere?
No. The HMAC is computed in your browser with the Web Crypto API. This page loads no ads, analytics or third-party scripts, and nothing you enter is logged or stored.
How do I check a webhook signature?
Put the exact raw request body in Message and your signing secret as the key, then paste the signature header value (without a prefix like “sha256=”) into Expected HMAC. Even one changed byte, such as re-formatted JSON, gives a different result.
Text, hex or base64 key?
It must match how the other side uses it. Many services give the secret as a text string; some give it as hex or base64 that must be decoded to bytes first.
Is the comparison safe against timing attacks?
Verification uses Web Crypto’s own constant-time check. In your own server code, always compare signatures with a constant-time function such as hash_equals() in PHP.
Is HMAC-SHA-1 still secure?
HMAC-SHA-1 is not known to be broken, unlike plain SHA-1, but prefer SHA-256 or better for anything new.