How to use the HMAC Generator
- 1. Enter message and keyPaste the exact message body and your shared secret.
- 2. Pick algorithm and formatChoose HMAC-SHA256 or another, and the output encoding.
- 3. Generate or compareGet the signature, or paste one to check it matches.
What HMAC is
An HMAC (hash-based message authentication code) proves that a message came from someone who knows a shared secret and that it was not changed on the way. It mixes the key into the hash twice: HMAC = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ message)). Without the key, nobody can produce a valid signature, even if they can read the message.
The default input is test case 2 from RFC 4231, the official HMAC-SHA256 test vectors: key "Jefe" and message "what do ya want for nothing?". The result starts 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843, matching the RFC, which shows the tool computes HMAC correctly.
Webhooks and APIs
- Payment and Git webhooks send an HMAC of the request body in a header. Recompute it with your secret and compare before trusting the event.
- Use the raw body. Re-formatted JSON, extra spaces or a different line ending change the signature.
- Prefixes like sha256= in a header are stripped automatically when comparing here.
- Compare in constant time in your own code, to avoid timing attacks.
HMAC-SHA1 still appears in older APIs and is considered acceptable for HMAC, but prefer SHA-256 for new work. HMAC is not encryption; the message stays readable. Signatures are computed with your browser's Web Crypto API, and neither the key nor the message leaves the page. Decode a JWT that uses HS256 (HMAC-SHA256) with the JWT decoder, or hash files with the file hash checker.
Frequently asked questions
Why does my signature not match the provider's?
Usually the message differs slightly, such as parsed JSON instead of the raw body, or the key is in the wrong format (text vs hex).
Is HMAC the same as a hash?
No. A hash needs no key, so anyone can compute it. An HMAC needs the secret key.
Is the HMAC Generator free?
Yes, the HMAC Generator is free. The first time you generate your first signature, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.