HMAC generator

Keyed hashes for webhooks and API signatures — SHA-256 and SHA-512 via Web Crypto, entirely in this tab.

Privacy Nothing leaves your browser: no accounts, no uploads, and no telemetry from this page. Clear the fields when you are done on shared machines.

Secrets & timing Do not paste production signing keys on untrusted or shared devices. For verification in your own services, compare digests in constant time (for example crypto.timingSafeEqual in Node) so lengths and byte differences do not leak hints.

Not supported here This browser does not expose crypto.subtle for HMAC (often HTTP pages or very old engines). Try a current desktop browser over HTTPS or open the deployed Pablobot site.

Inputs

Algorithm Secret key Message

Try a known vector

Loads the familiar Jefe / what do ya want for nothing? pair and its known SHA-256 hex so verify shows a match; checks out against openssl dgst -sha256 -hmac 'Jefe' on the same UTF-8 bytes.

Signature

Hexadecimal

Enter a secret and message to compute HMAC.

Base64

—

GitHub webhook header

SHA-256 HMAC required for X-Hub-Signature-256.

GitHub-style X-Hub-Signature-256: sha256=<hex> from the current SHA-256 result — not Stripe t=,v1=.

OpenSSL one-liner

Enter a secret and message to build the matching openssl command.

Bash on a UTF-8 locale: secret and message bytes match this desk’s TextEncoder UTF-8 inputs (same assumption as the sample vector). Single-line payloads use echo -n '…'; multiline copies printf '%s' $'…' with escaped newlines. Raw binary, hex keys, and PowerShell/cmd syntax are out of scope — openssl prints (stdin)= <hex>; compare that hex to the desk output.

Verify expected MAC

Paste a hex or Base64 digest (optional sha256= / sha512= prefix). Desk check against the computed signature above — use constant-time compare in your own server for production verification.

Expected MAC