A short companion for HMAC Generator: when it is useful, what it expects, and what to check before using the result.
What it does
Compute an HMAC over a message using SHA-256, SHA-384 or SHA-512 and a shared secret, then copy the result as hex or base64. Paste an expected HMAC to check it against the message and key, which is how a webhook signature is normally verified. The computation uses WebCrypto.
Use the tool
Open HMAC Generator, add the input the tool asks for, run it, and check the output before using it elsewhere.
Input and output
- Input: text.
- Output: text.
- Category: Crypto.
Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.
Questions
What is the difference between an HMAC and a plain hash?
A plain hash proves nothing about who produced it. An HMAC mixes in a secret, so only someone holding that secret can produce the same value — which is what lets you verify that a webhook came from the service you expect.
Should I use hex or base64?
Either works; they are the same bytes in different clothes. Providers differ: GitHub sends hex, Shopify sends base64, and many APIs use base64 because it is shorter. The verify box accepts whichever you paste, so you can compare across formats.
How does the verify box decide if it matches?
It computes the HMAC for the current message and key, then compares it with what you pasted. A value that is all hexadecimal is compared as hex, anything else as base64. Whitespace is ignored so a value split across lines still matches.
Related guide
For broader background, see Security and Cryptography Basics for Developers.