About this tool
Calculate a supported HMAC signature from the entered message and secret using the selected hash algorithm. Match the input encoding and protocol requirements when comparing the result with a webhook or test vector.
Calculations and file processing run in this browser tab. The tool does not send working inputs or files to our hosting server.
मुख्य इनपुट और नियंत्रण हिंदी में देखने के लिए ऊपर “🇮🇳 हिंदी में देखें” चुनें। गणना और फ़ाइल प्रोसेसिंग इसी ब्राउज़र टैब में होती है; टूल आपके इनपुट हमारी होस्टिंग पर नहीं भेजता।
Features
- Work with Message / Webhook Payload Body; Secret Key (UTF-8 text or Hex bytes).
- Primary HMAC Algorithm: choose from HMAC-SHA256 (64-byte block, 256-bit MAC); HMAC-SHA512 (128-byte block, 512-bit MAC); HMAC-SHA384 (128-byte block, 384-bit MAC); HMAC-SHA1 (64-byte block, 160-bit MAC).
- Secret Key Encoding: choose from UTF-8 Text Secret; Hexadecimal Key Bytes (e.g. 0b0b0b...).
- Review HMAC-SHA256 (Hex); HMAC-SHA256 (Base64); Key Length in the result breakdown.
Benefits
- Check a known message-and-key signature example.
- Keep message, secret and algorithm assumptions explicit.
Who should use this tool?
- Developers testing webhook-signature logic.
- Students studying message authentication.
How to use
- Complete the labelled fields for your scenario, including Message / Webhook Payload Body; Secret Key (UTF-8 text or Hex bytes). Use the units shown beside each field.
- Choose Primary HMAC Algorithm; Secret Key Encoding to match the situation you want to check.
- Select Calculate / Run Tool and review HMAC-SHA256 Signature (Hex) and HMAC-SHA256 (Hex); HMAC-SHA256 (Base64).
- Check the assumptions and limitations below. Adjust a value to compare scenarios, then copy or download the result you need.
Try these worked examples
| Scenario | Example inputs | Example result |
|---|---|---|
| RFC 4231 Vector #2: Key "Jefe", Data "what do ya want for nothing?" | Message / Webhook Payload Body: what do ya want for nothing?Secret Key (UTF-8 text or Hex bytes): JefePrimary HMAC Algorithm: HMAC-SHA256 (64-byte block, 256-bit MAC)Secret Key Encoding: UTF-8 Text SecretPayload Newline Mode: Normalize to LF (\n) | 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843 |
| Razorpay order_id|payment_id with HMAC-SHA512 | Message / Webhook Payload Body: order_9A33XWu170gUtm|pay_29QQoUBi66xm2fSecret Key (UTF-8 text or Hex bytes): test_webhook_secret_123Primary HMAC Algorithm: HMAC-SHA512 (128-byte block, 512-bit MAC)Secret Key Encoding: UTF-8 Text SecretPayload Newline Mode: Normalize to LF (\n) | 47e97e1276d305ba675b1e1f9cc8ccefc6e56d9ff2b7eaa393f6db65502a6b894466b8f2eccb6cbb6b2c392a4893aba67e031fc8f5282f9263655d9f719fbdce |
Reference and processing
IETF RFC 2104 HMAC & RFC 4231 HMAC-SHA-224/256/384/512 Test Vectors · Listed applicability: 2025-2026
Calculations and file processing run in this browser tab. The tool does not send working inputs or files to our hosting server.
FAQs
Does HMAC encrypt the message contents?
HMAC produces a keyed authentication value; it does not encrypt the message. Verification must use the appropriate secret, algorithm and exact payload bytes.
Which inputs do I need for HMAC-SHA256, HMAC-SHA512, HMAC-SHA384 & HMAC-SHA1 Signature Generator?
Use Message / Webhook Payload Body; Secret Key (UTF-8 text or Hex bytes); Primary HMAC Algorithm; Secret Key Encoding, then complete the remaining fields for your scenario. The built-in examples show how those fields fit together.
What should I check before using this result?
Uses 64-byte block size for SHA-1/SHA-256 and 128-byte block size for SHA-384/SHA-512 per RFC 4231. Keys longer than the block size are hashed first per RFC 2104. Check the assumptions and output against your intended task before relying on the result.
What happens to the information I enter?
Calculations and file processing run in this browser tab. The tool does not send working inputs or files to our hosting server. Tool favourites save only tool IDs in this browser. Sharing sends the tool link, not your working values or files.