Gerador HMAC

Generate HMAC SHA1/SHA256 hashes

100% gratuito. Funciona totalmente no seu navegador: seus arquivos e dados nunca saem do seu dispositivo e nada é enviado para nenhum servidor.

key

Jump to the next useful tool without leaving your flow.

See more

Sobre esta ferramenta

A plain hash proves a message was not altered. It does not prove who sent it, because anyone can compute a SHA-256 of anything - change the message, recompute the hash, and the tampering is invisible. HMAC closes that gap by mixing a secret key into the hashing process. Only someone holding the key can produce a valid code, so a matching HMAC proves both that the message is intact and that it came from a party who knows the secret. This is why it underpins webhook verification: when Stripe, GitHub or Slack send your server an event, they sign the payload with a shared secret, and checking that signature is what stops anyone from posting fake events to your endpoint. The critical implementation detail is comparison. Checking signatures with a normal string equality leaks timing information an attacker can measure to recover the key byte by byte - constant-time comparison is required. Computation here runs in your browser.

Como usar esta ferramenta

  1. Enter your messageThe exact payload to sign - for webhook verification this is the raw request body, byte for byte.
  2. Enter the secret keyThe shared secret. Use a test key rather than a production one when exploring.
  3. Choose the algorithmSHA-256 for anything new. SHA-1 remains only for compatibility with older systems.
  4. Compare the resultIn real code, compare with a constant-time function, never with a plain string equality check.

Por que usar

  • Proves authenticity as well as integrity, which a plain hash cannot do.
  • Supports the SHA-256 algorithm that current systems expect.
  • Runs in your browser, so keys and payloads are never transmitted.
  • Useful for debugging webhook signature mismatches directly.
  • No account and no rate limit.

Usos comuns

  • Verifying a webhook signature from Stripe, GitHub, Slack or a similar provider.
  • Signing an API request where the service requires an HMAC header.
  • Debugging why a signature check is failing between two systems.
  • Generating a test signature while implementing verification.
  • Learning how HMAC differs from plain hashing.

Dicas para melhores resultados

  • Sign the raw request body exactly as received. Parsing to JSON and re-serialising changes the bytes and breaks the signature - this is the most common webhook verification bug.
  • Compare signatures with a constant-time function. Normal string comparison exits early on the first mismatch, which leaks the key over many attempts.
  • Use SHA-256. SHA-1 is only appropriate when an existing system requires it.
  • Check encoding: providers differ on whether the signature is hex or base64, and comparing across formats always fails.
  • Store the secret in an environment variable, never in source control.

Erros a evitar

  • Re-serialising the payload before signing, so the bytes differ from what the sender signed.
  • Using == or === to compare signatures, which is a genuine timing attack vector rather than a theoretical one.
  • Confusing HMAC with encryption. It authenticates a message; it does not hide it.
  • Comparing a hex signature against a base64 one and concluding the key is wrong.
  • Pasting a live production secret into any third-party tool out of habit.

Perguntas frequentes

A regular hash only proves data integrity (that it wasn't altered) but anyone can compute it. HMAC additionally requires a secret key, so it proves the message came from someone who knows that key - adding authentication on top of integrity verification.

API request signing (verifying a request genuinely came from an authorized client), webhook payload verification, and various authentication protocols where you need to confirm both integrity and origin of a message.

Computation happens entirely in your browser and nothing is transmitted. Even so, avoid pasting production secrets into any third-party tool as a matter of habit - use a test key when learning or debugging.

Almost always because the payload was parsed and re-serialised before signing. HMAC is computed over exact bytes, and JSON.parse followed by JSON.stringify changes key order and whitespace. Sign the raw body exactly as received.

Because ordinary string comparison returns as soon as it finds a difference. An attacker can measure that timing across many attempts to work out the correct signature one byte at a time. Every language has a constant-time comparison function for exactly this.

SHA-256 for anything new. HMAC-SHA1 is not broken in the way plain SHA-1 is, but there is no reason to choose it today - use it only when an existing system requires it.

Yes. Hmac Generator is free for normal use with no account required, and ToolBox does not add a watermark to your result.

Most tools in this category run in your browser so the file stays on your device. If a tool needs a temporary server job, files are handled for that job only and are not kept as a lasting archive.

As pessoas também pesquisam

  • hmac generator online
  • hmac sha256 calculator
  • verify webhook signature
  • hmac vs hash
  • sign api request hmac
  • stripe webhook signature check
  • hmac authentication explained

Related guides