HMAC Generator
Enter a message and a secret key, choose the hash and get the HMAC as hex or Base64. Useful for checking webhook signatures and API request signing.
Worked examples
A published test vector
Key "Jefe", message "what do ya want for nothing?", SHA-256
5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
This is test case 2 from the HMAC test vectors in RFC 4231.
MD5 test vector
Key "Jefe", message "what do ya want for nothing?", MD5
750c783e6ab0b503eaa86e310a5db738
This is a test case from RFC 2202.
About HMAC Generator
An HMAC is a signature made from a message and a secret key. Only someone who has the key can produce the right value, so a receiver can recompute it and be sure the message came from the sender and was not changed on the way. Payment providers, code hosting services and chat platforms use it to sign webhooks, and many APIs use it to sign requests.
Type the message and the key, choose the hash and read the result as hex or Base64. The key can be text, hex bytes or Base64, which matters because providers often hand out secrets in one of the encoded forms and the bytes behind them are what the signature uses. When a signature you computed does not match the one a service sent, the usual causes are a key in the wrong form, a body that was changed in transit, or a different hash.
How to use HMAC Generator
- Enter the message exactly as it will be signed, including spaces and line breaks.
- Enter the secret key and say whether it is text, hex or Base64.
- Choose the hash, usually SHA-256, and the output form.
- Copy the HMAC and compare it with the one you received.
Common uses
- Checking a webhook signature while debugging
- Signing an API request by hand to test a service
- Producing known values for unit tests
- Learning how HMAC changes when the message or key changes
Frequently asked questions
What is the difference between a hash and an HMAC?
A hash has no key, so anyone can compute it. An HMAC mixes in a secret key, so only a holder of the key can compute or check it.
Does the key length matter?
Keys longer than the hash block size are hashed first and shorter keys are padded with zeros, so any length works. An empty key is allowed and gives the correct value for an empty key.
Why does my result differ from the service?
Check that the message is byte for byte what the service signed, that the key is decoded the way the service expects, and that you chose the same hash. A trailing line break counts.
Which hash should I choose?
SHA-256 is the usual choice and is used by most modern services. SHA-1 and MD5 are offered for older systems that still use them.
What is Base64 URL style?
A form of Base64 that uses - and _ instead of + and / and leaves off the = padding, so the value can sit in a URL. JSON Web Tokens use it.