Skip to main content
ZeyroVault Tools

HMAC Calculator

Calculate HMAC signatures using SHA-256, SHA-1, or MD5 entirely in your browser. Zero-knowledge architecture, no key transmission.

An HMAC here is computed with SHA-256, SHA-1 or MD5 over the exact bytes you supply. Verification only succeeds if both sides built the identical string, so canonicalization matters more than the algorithm choice.

Tool workspace

Hash Algorithm

Message size: 0.00 MB of 10 MB — larger messages are rejected before signing.

Key processed in your browser only.

Output Format

API Authentication

Use HMAC-SHA256 for API request signing. Include timestamp to prevent replay attacks.

Webhook signature example

Verify the raw request body exactly as received — re-serializing JSON changes the bytes and breaks the signature.

// Node.js — verify a webhook signature
import { createHmac, timingSafeEqual } from 'node:crypto';

export function verifyWebhook(rawBody, signature) {
  const expected = createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(rawBody)          // raw bytes, not JSON.stringify(req.body)
    .digest('hex');

  const a = Buffer.from(expected, 'hex');
  const b = Buffer.from(signature, 'hex');
  return a.length === b.length && timingSafeEqual(a, b);
}

Use a constant-time comparison and reject stale timestamps to prevent replay attacks.

No result yet

Enter your input above and the result will appear here.

How It Works
How to Calculate HMAC Signatures

Learn how to calculate HMAC signatures for API authentication and data integrity verification using a zero-knowledge, client-side tool.

  1. 1

    Select hash algorithm

    Choose SHA-256 (recommended), SHA-1, or MD5 based on your security requirements.

  2. 2

    Enter message and key

    Input the message/data to sign and your secret key. The key never leaves your browser.

  3. 3

    Choose output format

    Select hexadecimal or Base64 encoding for the signature.

  4. 4

    Calculate and copy

    Click calculate to generate the HMAC signature, then copy it for use in your application.

Common Use Cases
  • 1Sign webhook payloads so recipients can verify the sender
  • 2Authenticate API requests between services without exchanging passwords
  • 3Verify that a message was not altered while in transit
  • 4Create signed request bodies for idempotent, replay-protected calls

Frequently Asked Questions

What is HMAC used for?

HMAC verifies message authenticity and integrity using a shared secret. It is common for API request signing and webhook payload validation.

Which algorithms are available?

SHA-256 (recommended), SHA-1, and MD5.

Is my secret key sent anywhere?

No. The key and message are processed locally in your browser and never leave your device.

How do I verify a webhook signature?

Compute the HMAC over the exact raw request body with the shared secret, then compare the hex or base64 result with the signature header. The expected-value field compares both in constant time, so a mismatch is reported without revealing where the strings differ.

Does the input encoding change the HMAC?

Yes. HMAC operates on bytes, so the same text sent as UTF-8, hex, or Base64 produces different inputs. Use the encoding the sender used and hash the raw body rather than a re-serialized JSON object.

Related Guides

Related Tools

Network-verified: see this tool's measured requests

Encryption background on zeyrovault.com

Your inputs remain on your device.

You are responsible for key management and output validation.