HMAC-SHA256 test vector
message: hello world secret: devtools-secret
Hex signature: e7204d03b5918af15e32f91af88a245ad1c3e8e3be58eee03223f0386d202de6
HMAC Generator & Verifier
Compute an HMAC (hash-based message authentication code) over a message with a shared secret, entirely in your browser via the Web Crypto API. Neither the message nor the secret is ever uploaded, added to the URL, or logged.
Message
Secret key
Algorithm
Output encoding
Signature
Verify against an expected signature
Copy examples
Node.js
const crypto = require('crypto');
crypto.createHmac('sha256', secret).update(message).digest('hex');Python
import hmac, hashlib hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest()
HMAC verification examples
An HMAC authenticates exact message bytes with a shared secret; a changed byte produces a different signature.
Webhook verification
HMAC(secret, rawRequestBody)
Verify the untouched raw body before parsing JSON or normalizing whitespace.
Common mistakes
- Hashing the message without a secret.
- Signing parsed JSON instead of the exact received bytes.
- Using a normal early-exit string comparison for signatures.
Examples and guidance reviewed .
