← Tools

HMAC Generator

Sign a message with a secret key, or check a webhook signature.

Private: your files never leave your device.

Signature

Check a signature

Your message and key stay on this device. Nothing is sent anywhere.

How it works

  1. Choose your files.
  2. Adjust the settings if you like.
  3. Download the result, or send it to another device with BroAllDone.

Frequently asked questions

How do I create an HMAC?

Type the message and the secret key, and choose the algorithm. The signature appears as you type, ready to copy.

How do I check a webhook signature?

Paste the request body as the message and your webhook secret as the key, then paste the signature from the header into Check a signature. Prefixes like sha256= are understood.

My key is in hex or Base64. Can I use it?

Yes. Choose Key is Hex or Base64 so the key's bytes are used, not its text.

Which output format do I need?

Most APIs use hex. Some use Base64 or Base64URL, and GitHub-style webhooks use sha256= followed by hex.

Which algorithms are supported?

HMAC with SHA-256, SHA-384, SHA-512, SHA-1, MD5, SHA3-256 and SHA3-512.

Is my key safe?

Yes. Everything happens in your browser, so your message and key never leave your device.

More free tools