HMAC Generator
Computes an HMAC over a message with a chosen hash and key encoding, for webhook signature checks.
Computes an HMAC — a keyed digest — over text or a file, with the key read as text, hex or Base64. It is the same screen as the hash tool with its HMAC half turned on, because an HMAC is a hash with a key and separating them would mean two pages that share every control.
Input
Drop a file to checksum it
Read in this tab. Nothing is uploaded.
Text is hashed as UTF-8 bytes, which is what every other tool means by hashing a string.
Digests
Paste a published checksum; the matching row lights up.
| Algorithm | Digest | Copy |
|---|---|---|
| MD5Collisions are cheap to construct. Fine as a checksum, not for signatures or passwords. | ||
| SHA-1Collisions have been demonstrated. Fine for a legacy checksum, not for anything new. | ||
| SHA-256 | ||
| SHA-384 | ||
| SHA-512 | ||
| CRC-32An error-detecting code, not a hash. Two files can share one by accident, let alone on purpose. |
Input
0 byte
Source
text box
How to use it
Turn on HMAC
The key field appears, and CRC-32 drops out of the table — it is a checksum, not a hash function, and has no HMAC.
Say how the key should be read
This is where HMACs usually go wrong. A key written as `0a1b2c` is three bytes as hex and six as text, and the two produce completely different digests.
Compare against the signature you were sent
Paste it in the compare box; the matching row lights up. Webhook signatures from Stripe, GitHub and Slack are all HMAC-SHA256 over a specific string, so getting the message right matters as much as the key.
Common questions
Why does my HMAC not match the one in the header?
Usually the message, not the key. A webhook signature is computed over an exact string — often the timestamp, a separator and the raw body — and a body that has been through a JSON parser and re-serialised is a different string. Sign the bytes you received.
Is HMAC the same as hashing the key and the message together?
No, and that is the point of it. `hash(key + message)` is vulnerable to a length-extension attack on MD5, SHA-1 and SHA-256; HMAC’s two-pass construction with the inner and outer padding is what removes that. Never build your own.
Does the key leave the tab?
No. It is used to import a WebCrypto key in this tab and nothing else — not transmitted, not stored, not put in the URL. Reloading the page loses it, which is the correct behaviour for a secret.
How long should the key be?
At least as long as the digest — 32 bytes for SHA-256. HMAC accepts any length, but a key longer than the block size is hashed down first, and a short key is simply a short key: the security is the entropy you put in.
Feed it from
Text Hash
Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.
TOTP Code Generator
Turns a TOTP secret into the current six-digit code with a countdown, for testing 2FA setups.
Random Key Generator
Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.
JSON Formatter & Validator
Pretty-prints, minifies and validates JSON, pointing at the exact line and column of a syntax error.
Next
These accept what this tool produces, so the result can go straight in.
Text Hash
Computes MD5, SHA-1, SHA-256, SHA-384, SHA-512 and CRC-32 of a string, with an uppercase and Base64 output option.
JWT Decoder
Decodes header and payload, shows claim expiry in local time, and checks the signature against a supplied key.
Random Key Generator
Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.
Base64 Encoder & Decoder
Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.
curl to Code
Converts a curl command into fetch, axios, Python requests, Go, PHP or PowerShell.
JSON ⇄ CSV
Flattens nested JSON into columns or rebuilds objects from a table, with a dot-path column naming rule.