Help
About this tool
Generate HMAC (Hash-based Message Authentication Code) signatures entirely in your browser. Type a message, enter a secret key, then choose MD5, SHA-1, SHA-256 or SHA-512. The result is shown as hex (lowercase or uppercase) or Base64 and can be copied in one click. Everything runs locally with the hash-wasm codecs, so neither the message nor the secret key ever leaves your device — ideal for checking webhook signatures from GitHub, Stripe or payment callbacks.
How to use
- Pick an HMAC algorithm (MD5, SHA-1, SHA-256 or SHA-512).
- Enter the message to sign and the secret key.
- Choose hex (lowercase or uppercase) or Base64 output and copy the resulting MAC.
How is HMAC different from a plain hash?
A plain hash only takes the message, so anyone can recompute it. HMAC mixes in a secret key, producing a message authentication code that proves both integrity and authenticity — only parties holding the key can produce or verify it.
Can I use this to verify GitHub or Stripe webhook signatures?
Yes. Both GitHub and Stripe sign webhook bodies with HMAC-SHA256 using your endpoint's signing secret. Paste the raw request body as the message and the signing secret as the key, then compare the hex digest with the signature header (GitHub sends sha256=…, Stripe sends v1=…). Make sure you use the exact raw body.
Is my key or message uploaded anywhere?
No. HMAC is computed entirely in your browser with the hash-wasm WASM codecs. Neither the secret key nor the message is ever sent to a server, so you can safely use real signing secrets here.