HMAC Generator: SHA-256, SHA-512 and SHA-1
Keyed HMAC signatures with SHA-1, SHA-256, SHA-384 or SHA-512.
Use via API
Compute an HMAC (SHA-1, SHA-256, SHA-384 or SHA-512) of a message with a secret key, e.g. to sign or check webhook payloads. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/hmac-generator
curl https://pithlab.com/api/v1/tools/hmac-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"message":"{\"event\":\"payment.succeeded\",\"id\":\"evt_123\"}","key":"whsec_test_secret","algorithm":"SHA-256"}'About the HMAC Generator
Generate HMAC-SHA256, HMAC-SHA512, HMAC-SHA384 or HMAC-SHA1 signatures with a text, hex or Base64 key. Output as hex or Base64, computed in your browser.
How to use the HMAC Generator
- Pick the hash algorithm. HMAC-SHA256 is the most common choice for APIs and webhooks.
- Enter the secret key and say whether it is plain text, hex or Base64.
- Enter the message to sign, as text or hex.
- Choose hex or Base64 output to match what the other system expects, then copy the result.
Examples
Input
Key "key", message "The quick brown fox jumps over the lazy dog"
Output
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Input
Key "key", message "The quick brown fox jumps over the lazy dog"
Output
97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=
Input
Key "Jefe", message "what do ya want for nothing?"
Output
effcdf6ae5eb2fa2d27416d5f184df9c259a7c79
Frequently asked questions
What is an HMAC?
An HMAC is a hash that mixes in a secret key. Anyone with the key can check that a message came from someone else with the key and was not changed on the way. It is widely used to sign webhooks and API requests.
Why doesn't my signature match the one from the API?
Check that the key format is right (many services give a hex or Base64 key that must be decoded first), that the message is byte for byte identical including whitespace and line endings, and that you compare in the same output format.
Is HMAC-SHA1 still safe?
HMAC-SHA1 is not broken in the way plain SHA-1 is, because collisions alone do not let an attacker forge an HMAC. Even so, prefer HMAC-SHA256 for anything new.
Is my key sent anywhere?
No. The HMAC is computed with your browser's built-in Web Crypto API and nothing is sent to a server. Avoid pasting live production keys on shared or untrusted computers.