HMAC Generator
Compute an HMAC over a message using a key you supply.
Loading tool…
About this tool
Computes a keyed message authentication code, which proves a message came from someone holding the shared secret and has not been altered. This is what webhook signatures use — the sender signs the payload, and you recompute the same HMAC to check it.
Limitations
- The key lives in browser memory for the duration of the operation and is never stored.
- Useful for checking a webhook signature locally. Do not paste production signing keys into any web page, including this one.
Questions
- Is my secret key safe here?
- It stays in this tab's memory for the length of the operation and is never stored, logged or transmitted. It is still better practice to use a test key rather than a production one.
- How is this different from a plain hash?
- A hash proves the content is unchanged. An HMAC additionally proves who produced it, because computing it requires the key.
- My signature does not match the sender's.
- Usually a difference in what exactly was signed — the raw request body rather than a re-serialised version of it, or a different encoding of the result. Compare the exact byte sequence, not the parsed object.
Privacy
This page does its work in your browser. What you paste is processed by JavaScript running on your own device and is never sent to a DevToolery server — there is no server that could receive it. The page itself is a static file delivered by a CDN. See exactly what is stored.