Is HMAC the same as SHA256?

No. HMAC wraps a hash function with a secret in a specific two-pass construction (RFC 2104) that resists length-extension attacks. `sha256(secret + message)` is not safe; HMAC-SHA256 is.

How long should my HMAC secret be?

At least as long as the hash output — 32 bytes for HMAC-SHA256. Longer keys do not add security beyond the block size; shorter ones reduce it. The tool warns when the decoded secret is shorter than the digest.

Why does my webhook signature not match?

Almost always because the signed bytes differ: the body must be the raw request body (not re-serialised JSON), the timestamp must be the one from the header, and the secret must be the endpoint/signing secret rather than an API key. Check the "Signed" preview to see exactly what is being hashed.

Is the secret stored?

No. Only the preset, algorithm, encoding and template persist between visits. The secret and message stay in memory and nothing is sent to a server.

HMAC Generator & Verifier

Compute HMAC signatures over text or file bytes with a shared secret given as UTF-8, base64 or hex. Presets reproduce real webhook schemes — Stripe (`t=…,v1=…` over `timestamp.payload`), GitHub (`sha256=`), Shopify (base64), Slack (`v0:ts:body`) and Twilio (URL + sorted params, HMAC-SHA1) — and a template field builds any timestamp+payload signed string. Paste a received signature to verify it with a constant-time comparison. Hex, base64 and base64url outputs are shown together; empty messages are allowed.

Runs locally in your browser

Preset

Shared secret

Secret encoding

Message (raw body — empty is allowed)

0 chars · 1 line

HMAC-SHA-256 signature

HexEnter a secret to sign

Base64Enter a secret to sign

Base64urlEnter a secret to sign

Verify a received signature

Secret

—

Message

0 B

Algorithm

HMAC-SHA-256

Digest

—

Hash Generator

MD5, SHA-1, SHA-256/384/512, SHA-3, CRC32 and xxHash32 for text, lines and files — with verify and checksum export.

JWT Decoder

Decode, verify (HS/RS/ES/PS, JWKS) and sign JWTs

Bcrypt Generator / Checker

Hash passwords with bcrypt, verify hashes, generate salts and benchmark cost factors on your device.

How to use HMAC Generator & Verifier

1Pick a preset (or Custom) and the hash algorithm.
2Enter the shared secret and choose how it is encoded (UTF-8, Base64 or hex).
3Paste the raw message body — or upload a file — and set the timestamp if the preset needs one.
4Copy the hex/base64/header value, or paste a received signature to verify it.

About HMAC Generator & Verifier

HMAC Generator & Verifier is part of FizzKit — a collection of focused developer and ad-tech tools. Because everything runs locally, it works offline once loaded and never exposes your data to a remote server.

Frequently asked questions

Verifying both the integrity and authenticity of a message. If you share a secret with the sender, an HMAC proves the message came from them and was not tampered with — which is why webhooks from Stripe, GitHub, Shopify and Slack are signed this way.

Related tools