HMAC Generator (Base64)

How to compute an HMAC in Base64

1. HMAC mode and SHA-256 are selected. Pick another algorithm under Algorithm if your API uses SHA-1, SHA-384, SHA-512 or MD5.
2. Enter the Secret key and set Key is: Text (UTF-8) for a normal secret string, Hex or Base64 if the key is given as encoded bytes.
3. Type or paste the message into Text, or switch Input to File and drop the exact payload file.
4. Copy the signature as Base64, Base64URL or hex. All algorithms shows the HMAC with every hash at once, which helps when the documentation is vague about which one is used.

An empty key is accepted and still gives a result, with a note that such an HMAC protects nothing.

Example values

With the key key and the message The quick brown fox jumps over the lazy dog:

The HMAC-SHA256 value in hex is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8, the familiar test vector from the Wikipedia article on HMAC. Key encoding changes the result: the text a2V5 used as a key gives 5O+7AtpguFrgIRw1qXGU+m0OaTs1oV1kwRQ/hI1WAUE=, while a2V5 read as Base64 is the bytes of key and gives 97yD9DBT… again.

Webhook signatures: Base64 or hex

Providers agree on HMAC but not on the output encoding or on what is signed. A few well-documented examples:

When a value from this tool matches the hex but your code compares Base64, or the other way round, the computation is right and only the encoding differs. Check the provider’s documentation for what is signed; the timestamp prefixes exist to stop replays of old requests.

Verifying a signature in code

Compare raw bytes in constant time, and make sure you hash the body exactly as received:

const crypto = require("crypto");

function verifyWebhook(rawBody, secret, signatureHeader) {
  const expected = crypto.createHmac("sha256", secret).update(rawBody).digest();
  const given = Buffer.from(signatureHeader, "base64");
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

With rawBody as the Buffer of the fox sentence, secret key and the Base64 value from the table, it returns true. Feed it JSON.stringify(JSON.parse(body)) instead of the raw body and it returns false as soon as the provider’s JSON had a space your serializer drops. In Express, that means reading the body with express.raw() on the webhook route.

The Python equivalent uses hmac.new(key, body, hashlib.sha256).digest(), Base64-encodes it and checks with hmac.compare_digest. For the command line, openssl dgst -sha256 -hmac 'key' -binary | base64 gives the same Base64; use -mac HMAC -macopt hexkey:… when the key is hex. For a strong key, the HMAC secret preset of the Base64 key generator makes 32 random bytes. For signed tokens rather than signed requests, see the JWT encoder.

FAQ