# HMAC Generator

Compute keyed HMAC signatures with a choice of digest.

## URL

https://ilham.dev/tools/hmac-generator/

## What It Does

Compute an HMAC over a message using SHA-256, SHA-384 or SHA-512 and a shared secret, then copy the result as hex or base64. Paste an expected HMAC to check it against the message and key, which is how a webhook signature is normally verified. The computation uses WebCrypto.

## Features

- Runs in the browser
- No login required

## Input

text input.

## Output

text output.

## Privacy

Processing happens locally in the browser.

No input data is uploaded to ilham.dev.

- Requires login: false
- Requires API key: false
- Stores user data: false


## Examples

- What is the difference between an HMAC and a plain hash?
- Should I use hex or base64?
- How does the verify box decide if it matches?




## Questions

### What is the difference between an HMAC and a plain hash?

A plain hash proves nothing about who produced it. An HMAC mixes in a secret, so only someone holding that secret can produce the same value — which is what lets you verify that a webhook came from the service you expect.

### Should I use hex or base64?

Either works; they are the same bytes in different clothes. Providers differ: GitHub sends hex, Shopify sends base64, and many APIs use base64 because it is shorter. The verify box accepts whichever you paste, so you can compare across formats.

### How does the verify box decide if it matches?

It computes the HMAC for the current message and key, then compares it with what you pasted. A value that is all hexadecimal is compared as hex, anything else as base64. Whitespace is ignored so a value split across lines still matches.