HMAC Calculator - Verify SHA-256/512 signatures in browser

Input

Message (what is signed; for webhooks, the raw received body)

Hash function

How to read the key

Shared secret (key) Signature to verify (optional; paste the one you received) Samples

How to use: enter a message and a shared secret to get the HMAC in both hex and Base64. Paste a received signature into the verify field and the tool tells you which encoding matched.
The most common webhook mistake: the signed value is the raw received body. A string produced by parsing and re-serializing the JSON changes whitespace and key order, which makes it a different message.
Watch how the key is read: the same characters give a different key depending on whether they are read as UTF-8 or as hex bytes. Follow the sender specification.

HMAC (signature)

Hex (lowercase)
—
Base64
—
Signature length in bytes
—
Verification
Paste a signature to check whether it matches

How to use it (5 steps)

An HMAC is determined by three things together: the message, the hash function and the key. If any one of them differs from the sender, the value changes.

Paste the message — Paste exactly what is signed. For webhook verification use the raw body, before any JSON re-formatting. A single differing byte changes the signature.
Pick the hash function — Match the sender specification, for example HMAC-SHA-256. Most services use SHA-256.
Choose how the key is read, then paste the secret — Pick UTF-8 for a plain string key, hex for a hex byte string, or Base64 for a Base64 key. Choosing the wrong one changes the result.
Read the output format you need — Both hex and Base64 are shown at the same time. Which one the sender uses depends on the specification.
Compare with the signature you received — Paste the received signature into the verify field to check for a match. A prefix such as sha256= is stripped automatically.

Frequently asked questions (FAQ)

How is HMAC different from a plain hash such as SHA-256?

A hash is computed from the input alone, so anyone who knows the input can produce the same value. HMAC also uses a shared secret key, so only the sender and receiver who hold the key can produce the same value. That is what makes it usable for proving who produced a message, which is exactly how webhook signature verification works.

Is the secret I type sent anywhere?

No. This tool uses only the browser built-in Web Crypto API (crypto.subtle) and everything is computed inside your browser. There is no request to a server and nothing is stored. Even so, avoid pasting production secrets into a browser on someone else machine or a shared terminal, regardless of how the tool is implemented.

My signature does not match. What should I check?

There are three common causes. First, the message: use the raw received body, not a re-serialized JSON string. Second, how the key is read: reading a hex key as UTF-8 gives a different key. Third, the output encoding: the sender may send Base64 while you compare against hex. This tool shows both hex and Base64, and tells you which one matched.

Can it compute HMAC-MD5?

No. The browser built-in Web Crypto API does not support MD5. The supported hashes are SHA-1, SHA-256, SHA-384 and SHA-512. HMAC-SHA-1 is not immediately broken by the known SHA-1 collisions because of how HMAC is constructed, but choose SHA-256 or stronger for new designs.

Can I confirm the results are correct?

Yes. The first two samples are RFC 4231 test vectors. The first uses a key of 0x0b repeated 20 times with the message Hi There, giving HMAC-SHA-256 b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7. The second uses the key Jefe with the message what do ya want for nothing?, giving 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843.