HMAC generator
Compute a keyed-hash message authentication code for any message.
Loading tool…
About the hmac generator
Computes a keyed hash over your message, the construction behind webhook signatures, signed URLs and API request authentication. Pick the hash function and output encoding to match whatever the receiving service expects.
Frequently asked questions
How is HMAC different from a plain hash?
A plain hash proves the content is unchanged; anyone can compute it. HMAC mixes in a shared secret, so a valid signature also proves the sender knew the key.
How do I verify a webhook signature?
Recompute the HMAC over the exact raw request body — before any JSON parsing or re-serialisation — and compare using a constant-time equality function, never a plain string comparison.