What is an HMAC and how does it prevent message tampering?

HMAC (Keyed-Hash Message Authentication Code) combines a cryptographic hash function with a secret shared key. It verifies both data integrity (that data wasn't changed) and authenticity (that only someone with the secret key created it).

How do I verify a webhook signature from Stripe or GitHub?

Switch to the 'Verify Signature' tab, paste the raw unparsed request payload string, input your webhook signing secret, and enter the header signature to confirm authenticity.

Is HMAC computation secure to run in the browser?

Yes, this tool executes 100% in your browser RAM using WebCrypto API primitives. No keys or payloads are ever sent across the network.

Security & Crypto

HMAC Generator & Signature Verifier

Calculate and verify cryptographically secure HMAC-SHA256, SHA-512, SHA-384, SHA-1, and MD5 signatures.

Quick Answer & Summary

An HMAC (Keyed-Hash Message Authentication Code) generator computes a cryptographic digest by hashing a message combined with a secret cryptographic key, ensuring both data integrity and authentication.

RFC 2104 HMAC Formula

HMAC(K, m) = H((K' ⊕ opad) ∥ H((K' ⊕ ipad) ∥ m))

Where H is the cryptographic hash function, K' is the normalized key, opad = 0x5c5c... and ipad = 0x3636... are outer and inner padding constants, and ∥ denotes concatenation.

HMAC Algorithm Settings

Zero Server Telemetry

Hash Algorithm

Key Encoding

Output Format

Message / Payload Data

Secret Key

Share This Tool

Help your team and fellow developers save time with free, private client-side utilities.

X (Twitter)LinkedIn WhatsApp Reddit Facebook

Toolbox Editorial TeamVerified Authors

Systems & Security Engineers • Applied Cryptography & High-Performance Web Tools

Updated: August 2026

100% In-BrowserZero server storage

Standards AuditedRFC & ISO compliant

Peer ReviewedEditorial Policy

Documentation & Guide

How to Use HMAC Generator & Signature Verifier

Enter Payload & Secret Key

Paste your request body, JSON payload, or query string alongside your shared secret key.

Select Hash & Encoding

Choose SHA-256 (standard), SHA-512, or SHA-1 with Hex or Base64 output formatting.

Copy Signature or Verify Webhook

Copy the computed hash to your authorization header or switch to Verify mode to test inbound payloads.

Practical Examples & Conversions

Input

Key: whsec_abc123, Msg: t=1614556800,v1={"id":"evt_123"}

Output

Computes hex digest for Stripe-Signature header matching

Frequently Asked Questions (PAA)

Related Tools & Converters

Hash Generator

SHA-256, SHA-512, MD5 hashes

Webhook Tester

Inspect and debug live webhooks

JWT Inspector

Inspect JSON Web Tokens

RSA Keypair Generator

Asymmetric RSA keys & encryption

Authoritative Standards & Citations

Calculations and algorithms on this page are implemented and verified in strict accordance with the following official technical specifications:

IETF (Internet Engineering Task Force)

RFC 7519: JSON Web Token (JWT)

Standardized compact, URL-safe means of representing claims to be transferred between two parties.

W3C Recommendation

Web Cryptography API Specification

Standard JavaScript API for performing basic cryptographic operations in web applications.

IETF Standards Track

RFC 4122: A Universally Unique IDentifier (UUID) URN Namespace

Definition of uniform format and generation algorithms for UUIDs.