tigtools

HMAC Generator

Compute a keyed message authentication code (HMAC) for a message and secret key, or check a signature you received. The key and message stay in your browser.

Runs in your browser No sign-up

The key and message are processed only in this browser tab and are never sent anywhere. Still, avoid pasting live production secrets on a shared or untrusted computer.
Key format

Signed as UTF-8 exactly as typed. A trailing space or line break changes the result.

Output

Paste a signature in hex (any case) or Base64 to compare it with the result above.

How to use it

  1. Enter the secret key and choose whether it is plain text or hex bytes.
  2. Paste the message, for example a webhook payload exactly as received.
  3. Choose the algorithm and output encoding your service uses; the HMAC updates as you type.
  4. To check a signature, paste it into the verify box and look for “Match”.

How it works

HMAC (RFC 2104) combines a secret key with a hash function to produce a signature that only someone with the key can create. Services such as webhooks and signed API requests send an HMAC with each message so the receiver can check that the message is authentic and unchanged.

This tool uses your browser's Web Crypto API (crypto.subtle.importKey and sign) and is checked against the RFC 4231 and RFC 2202 test vectors. A text key and the message are encoded as UTF-8. A hex key is decoded to raw bytes; spaces, colons and a leading 0x are ignored. HMAC-SHA-256 is the most common choice; HMAC-SHA-1 is still considered secure as a MAC but is mainly used by older APIs.

If your signature does not match, check the details that most often differ: the exact message bytes (many webhook providers sign the raw body, not re-formatted JSON), a timestamp or prefix that the provider adds to the signed string, whether the key is used as text or must be decoded from hex or Base64 first, and whether the expected signature is hex or Base64 and carries a prefix such as “sha256=”, which you should remove before comparing.

Examples

RFC 4231 test case

Key “Jefe” (text), message “what do ya want for nothing?” and HMAC-SHA-256 give 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843. Use “Try an example” to load it.

Checking a webhook signature

A provider sends the header X-Signature: sha256=… with each request. Paste the raw request body as the message, your webhook secret as the key, choose HMAC-SHA-256 and Hex, then paste the value after “sha256=” into the verify box.

A hex-encoded key

Some systems issue keys as hex strings such as 0b0b0b…. Choose Hex as the key format so the tool signs with the decoded bytes; treating the same string as text gives a completely different result.

Frequently asked questions

What is the difference between an HMAC and a plain hash?

Anyone can compute a plain hash such as SHA-256 of a message. An HMAC also depends on a secret key, so only someone with the key can produce or check it. That proves the message came from a key holder and was not altered.

Why does my HMAC not match the one from my server?

The input bytes almost always differ: line endings, whitespace, JSON key order, character encoding, or a key that should be decoded from hex or Base64. Also compare the same encoding (hex versus Base64) and remove prefixes like “sha256=”.

Is my secret key sent anywhere?

No. The key and message are used only by the Web Crypto API in this browser tab. They are not uploaded, stored or included in analytics.

Is HMAC-SHA-1 still secure?

SHA-1 collisions do not break HMAC-SHA-1 directly, and it is still accepted for compatibility. For new systems, use HMAC-SHA-256 or stronger.

Privacy

The key, message and result exist only in this browser tab. Nothing is uploaded, stored or sent to analytics; only an anonymous event that the tool was used is recorded.