HMAC Generator
Generate HMAC signatures for API authentication.
HMAC Signature
Quick Examples
Usage in Code
// Node.js
const crypto = require('crypto');
const signature = crypto.createHmac('sha256', secret).update(message).digest('hex');
// Python
import hmac
import hashlib
signature = hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()
// Go
import "crypto/sha256"
h := hmac.New(sha256.New, []byte(secret))
h.Write([]byte(message))
signature := fmt.Sprintf("%x", h.Sum(nil))
About the HMAC Generator
An HMAC is a hash of a message combined with a secret key. Services like Stripe and GitHub sign webhooks with HMAC so the receiver can prove a request is genuine.
How to use it
- 1 Paste the message, such as the raw request body.
- 2 Enter the secret key and choose an algorithm.
- 3 Compare the result with the signature header you received.
Frequently asked questions
Why does my webhook signature not match?
Most often the body was parsed and re-serialised before hashing. Sign the exact raw bytes received, and check whether the expected output is hex or Base64.
What is the difference between a hash and an HMAC?
Anyone can compute a hash. An HMAC also needs the secret key, so only the sender and receiver can produce it.
Is HMAC-SHA256 secure?
Yes, with a long random key. Compare signatures with a constant-time function to avoid timing attacks.