Skip to main content
DevStackKit
All tools

HMAC Signer

Create an HMAC signature with SHA-1, SHA-256, SHA-384 or SHA-512, or check a Stripe, GitHub or Razorpay webhook signature. Private.

More options

Message and key

HMAC-SHA-256

The signature appears here.

Shortcuts: Ctrl+Enter run · Ctrl+Shift+C copy result · / search (use ⌘ on Mac)

Next steps

Done here? Use the Send to… menu on the result to carry it on to Base64URL & Base32 Converter or Hash Generator.

Free Online HMAC Generator and Webhook Signature Checker

Sign a message with a secret key to get an HMAC, or paste a webhook request and its signature header to see if the signature is right. Stripe, GitHub and Razorpay formats are built in. It gives developers a quick browser-based way to solve a focused hmac signer task before moving the result into a project.

How to create an HMAC

Choose Create a signature, type the message and the secret key, choose the hash and press the button.

How to check a webhook

Choose Check a webhook, pick the service, paste the secret, the raw request body and the signature header value, then press Check signature.

Common mistakes

  • Pasting the body after a JSON formatter: even one space changes the signature.
  • Using the wrong secret for test and live mode: they are different keys.

Frequently asked questions

What is an HMAC?
A signature made from a message and a shared secret. Anyone who knows the secret can make or check it, and nobody else can, so it proves the message came from the sender and was not changed.
Why does my webhook signature not match?
The signature covers the exact raw bytes of the request body. A body that was pretty-printed, re-encoded, or had a line ending changed will not match. Paste the body exactly as your server received it.
How do Stripe, GitHub and Razorpay sign?
GitHub: HMAC-SHA256 of the body, sent as sha256=<hex>. Stripe: HMAC-SHA256 of "<timestamp>.<body>", sent as t=…,v1=…. Razorpay: HMAC-SHA256 of the body, sent as hex.
Is my secret uploaded?
No. Everything is calculated in your browser. Still, use test secrets here rather than live production ones.
How do I use this hmac signer tool?
Use the interactive controls above; processing stays in your browser and the result is intended as a practical starting point for development work.

More Security & Auth

JWT DecoderSee what is inside a login tokenEncode / DecodeTurn text into safe codes, and backHash GeneratorCreate a fingerprint of text or a filePassword GeneratorCreate strong passwords you can trustPassword Strength CheckerSee how strong your password really isCertificate DecoderRead what is inside an SSL certificateIBAN ValidatorCheck a bank account number (IBAN)CSP Header GeneratorBuild a security header for your website

View all Security & Auth tools →