HMAC Generator (SHA-256 and More)
Sign a message with a secret key using HMAC-SHA256, SHA-1 or SHA-512 and compare the result against what your code or a webhook sender produced. The fastest way to debug a signature mismatch without adding print statements to production.
How to use
- Paste the exact message (payload) to sign.
- Enter the secret key.
- Choose the hash algorithm, typically SHA-256.
- Generate and compare the hex digest against the signature you received.
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a hash function with a secret key so that a digest proves two things at once: the message was not altered, and it was produced by someone holding the key. A plain SHA-256 of a message can be recomputed by anyone. An HMAC cannot. The construction, hashing the key XORed with inner and outer pads around the message, also immunises it against the length-extension attacks that break naive hash(key + message) schemes.
You meet HMAC daily even if you never call it directly. Stripe, GitHub, Razorpay and Shopify sign their webhooks with HMAC-SHA256 so your server can reject forged callbacks. AWS Signature v4 chains HMACs to authorise every API request. JWTs with alg HS256 are HMAC-signed. Session cookies in most frameworks carry an HMAC to prevent tampering.
When a signature check fails, the cause is almost always one of four things: the message bytes differ (re-serialized JSON changes whitespace and key order, always sign the raw body), the key was decoded differently (hex vs base64 vs raw text), the output encoding differs (hex vs base64), or a timestamp prefix is required (Stripe signs timestamp.payload, not the payload alone). This tool lets you isolate the variable: fix the message and key here, and see exactly which digest your inputs produce. Comparisons in your own code should use a constant-time function like hmac.compare_digest to avoid timing attacks.
Examples
Input: message: hello, key: secret
Output: 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0bInput: message: user_id=42&amount=100, key: mykey
Output: 0ff025b1f2943885f4c9068b37d6d3dd18b7c75d73f5574a89fe9c4db58342afFrequently asked questions
What's the difference between a hash and an HMAC?
A hash proves only integrity, anyone can recompute it. An HMAC mixes in a secret key, so it also proves authenticity: only a party holding the key could have produced it. Use HMAC whenever the message travels through untrusted hands.
Why doesn't my webhook signature match?
Check four things in order: are you signing the raw request body (not re-parsed JSON), is the key in the right encoding, is the output hex vs base64 as the sender expects, and does the provider prepend a timestamp (Stripe does). One of those four explains nearly every mismatch.
Is it safe to enter my secret key here?
Velona computes the HMAC server-side and stores nothing for anonymous users. Even so, treat any secret pasted into any website as exposed: use a test key for debugging and rotate real keys through your provider's dashboard.
Should I use HMAC-SHA1 or HMAC-SHA256?
HMAC-SHA1 is not broken the way plain SHA-1 is, HMAC's structure protects it, but SHA-256 is the modern default and what nearly every current API expects. Use SHA-1 only for legacy integrations that require it.
Related tools
Velona is India's INR-native AI API gateway with 300+ models, UPI top-up from ₹10, no foreign card needed. These tools are free forever.