Crypto
HMAC Generator
Compute HMAC-SHA256, HMAC-SHA384, HMAC-SHA512. Hex or Base64 output. 100% client-side — secret never leaves browser.
Quick answer
Compute HMAC-SHA256/384/512 over a message with a secret key. Output hex or Base64, entirely in-browser. Use the Signature Checker / webhook validator to verify signatures against a payload.
About this tool
HMAC proves integrity and authenticity when both sides share a secret. This generator does not verify signatures — it only creates them via Web Crypto.
How to use
- Paste the exact message/payload bytes you will sign (raw body matters for webhooks).
- Enter the shared secret and choose SHA-256, SHA-384, or SHA-512.
- Copy hex or Base64 output into your API/webhook config, or verify with /signature-checker.
Common use cases
- Debugging Stripe/GitHub/Shopify-style webhook signatures.
- Teaching HMAC before wiring production verifiers.
- Comparing client and server HMAC outputs during integration tests.
Example inputs
message + secret → hex HMACwebhook raw body + signing secretCommon issues and fixes
Key mismatch
Verification fails if secret differs. Both sides must use same key.
Timing attack
Use crypto.timingSafeEqual when comparing HMACs to prevent timing attacks.
Body mismatch
Signing a pretty-printed JSON body while the server signs the raw request body will never match.
Recommended remediation
Use HMAC for webhook signatures and API auth. Keep secrets out of repos. Prefer SHA-256+. Verify with /signature-checker or /security/webhook-signature-validator.
Pro tips
- Sign the raw body string exactly as received.
- Some providers prefix digests (sha256=...). Strip or add prefixes to match docs.
- Encryption (AES) does not replace HMAC for integrity.
FAQ
Does this tool support HMAC-SHA1?
No. This generator supports SHA-256, SHA-384, and SHA-512 only. Prefer SHA-256+ for new integrations.
How do I verify an HMAC signature online?
Use /signature-checker or /security/webhook-signature-validator with the same payload, secret, and algorithm.
Is my secret sent to ValidateThis?
No. HMAC runs in your browser with the Web Crypto API — the secret never leaves the device.
Related security tools
JWT Decoder
Decode JSON Web Tokens to inspect header, payload, and expiration without a secret key.
Base64 Encoder / Decoder
Encode and decode text to and from Base64 format. Fully client-side — your data never leaves the browser.
AES Encrypt / Decrypt
AES-256-CBC encryption and decryption. 100% client-side. PBKDF2 key derivation.
Webhook Signature Validator
Verify Stripe and GitHub webhook signatures. HMAC-SHA256. 100% client-side — secret never leaves browser.
Run a full security check
After this tool passes, run related header and policy checks to catch transport and browser-level risks.