HMAC Calculator
Computes HMAC signatures for webhook debugging — SHA-256, SHA-512, SHA-1 and MD5; message and secret as UTF-8 text or raw hex bytes; hex and Base64 output; timing-safe compare against an expected signature; Stripe and GitHub presets.
Runs 100% in your browser — nothing you paste leaves your device.
Read the full guide to this tool
Notes
- An HMAC proves both integrity and authenticity: only someone holding the secret can produce a valid signature.
- Stripe signs {timestamp}.{raw_body}; GitHub sends sha256={hex} in X-Hub-Signature-256.
- Use demo keys only — everything runs locally in your browser, but production secrets should never be pasted into any tool.
- Runs 100% in your browser — nothing you paste leaves your device.