HMAC Generator

Compute the HMAC signature of a payload with your secret key to validate webhooks, sign API requests and debug signature mismatches.

Payload and key

HMAC-SHA-256

Enter a secret key

Use via API

Signs a message with HMAC.

POSThttps://enhanced.dev.br/api/v1/crypto/hmac
JSON body parameters
Body (JSON)TypeDescription
message *stringPayload exactly as it will be signed.
secret *stringSecret key (UTF-8).
algorithm"SHA-1" | "SHA-256" | "SHA-384" | "SHA-512"Default: "SHA-256".
encoding"hex" | "base64"Default: "hex".

Request example

curl -X POST "https://enhanced.dev.br/api/v1/crypto/hmac" \
    -H "Content-Type: application/json" \
    -d '{"message":"{\"event\":\"payment.succeeded\"}","secret":"whsec_minha_chave","algorithm":"SHA-256","encoding":"hex"}'

Response

{
  "ok": true,
  "data": {
    "algorithm": "SHA-256",
    "encoding": "hex",
    "signature": "2c5a750a657f62b38efa49ac2ee65ba334dd76a104bca7910039f9e900aff576"
  },
  "meta": {
    "version": "v1"
  }
}
  • Errors return { ok: false, error: { code, message } } with an HTTP 4xx/5xx status.
  • Free, no API key required. Limited to 120 requests per minute per IP.
  • CORS enabled: call it straight from the browser on any domain.

How to use

  1. Paste the payload exactly as it was received or will be sent.
  2. Enter the secret key.
  3. Choose the algorithm (HMAC-SHA256 is the most common).
  4. Select hex or Base64 to match the service's format and copy the signature.

Use cases

  • Validating webhook signatures from Stripe, GitHub, Shopify and payment gateways.
  • Signing requests between microservices.
  • Investigating why the signature computed by your back end does not match.

Technical concepts

How HMAC works

HMAC (RFC 2104) combines a hash function with a secret key: H((K ⊕ opad) || H((K ⊕ ipad) || message)). Only someone who knows the key can produce the correct signature, which guarantees the message's authenticity and integrity.

Byte for byte

The signature depends on every byte of the payload. Reformatting JSON, reordering keys or changing line endings produces a different signature. Always sign the raw request body, before any parsing.

Constant-time comparison

On the server, compare signatures with constant-time functions (crypto.timingSafeEqual in Node, hmac.compare_digest in Python) to prevent timing attacks.

Frequently asked questions

Is my secret key stored?

No. The key only exists in the page's memory and is used by the local Web Crypto API.

Why doesn't my signature match the service's?

The usual causes are a payload altered by parsing, a different output encoding (hex vs Base64) and prefixes such as sha256= or timestamps that the service concatenates before signing.

Is HMAC-SHA1 still secure?

Yes for HMAC: SHA-1 collisions do not break the HMAC construction in practice. Still, prefer SHA-256 for new systems.

Related tools