# HMAC Generator Guide

Compute keyed HMAC signatures with a choice of digest.

- Tool: https://ilham.dev/tools/hmac-generator/
- Guide URL: https://ilham.dev/guides/hmac-generator/
- Tool guides index: https://ilham.dev/guides/tools/
- Broader guide: Security and Cryptography Basics for Developers (https://ilham.dev/guides/security-cryptography-basics/)

## What it does

Compute an HMAC over a message using SHA-256, SHA-384 or SHA-512 and a shared secret, then copy the result as hex or base64. Paste an expected HMAC to check it against the message and key, which is how a webhook signature is normally verified. The computation uses WebCrypto.

## Use the tool

Open https://ilham.dev/tools/hmac-generator/, add the input the tool asks for, run it, and check the output before using it elsewhere.

## Input and output

- Input: text.
- Output: text.
- Category: Crypto.

## Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.

## Questions

### What is the difference between an HMAC and a plain hash?

A plain hash proves nothing about who produced it. An HMAC mixes in a secret, so only someone holding that secret can produce the same value — which is what lets you verify that a webhook came from the service you expect.

### Should I use hex or base64?

Either works; they are the same bytes in different clothes. Providers differ: GitHub sends hex, Shopify sends base64, and many APIs use base64 because it is shorter. The verify box accepts whichever you paste, so you can compare across formats.

### How does the verify box decide if it matches?

It computes the HMAC for the current message and key, then compares it with what you pasted. A value that is all hexadecimal is compared as hex, anything else as base64. Whitespace is ignored so a value split across lines still matches.