HMAC Generator
Sign a message with a secret key, or check a signature.
Questions
What is an HMAC used for?
Proving a message came from someone who knows the secret key and wasn’t changed on the way. Stripe, GitHub, Shopify and most webhook senders sign each request this way, and many APIs sign requests the same way.
Why doesn’t my signature match the webhook’s?
The message must be the exact raw body, byte for byte: no reformatting, no added line break. Check the key format too: some services give the secret as hex or Base64, which is different from using the same characters as text. Some also sign a timestamp together with the body.
Is it safe to type my secret key here?
The key stays on this page: nothing is sent or stored, and the page’s security policy blocks connections to other sites. For production secrets, use a key you can rotate, as with any tool.
Is it free? Do I need an account?
It is free to use and there is nothing to sign up for. There are no watermarks and no daily limits.
Missing something, or not working as it should? Tell us