HMAC Generator
Generate keyed HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 entirely in your browser. Perfect for webhook verification, API request signing, secret-based integrity checks, and authentication debugging.
Continue Your Code Journey
What is HMAC Generator?
The HMAC Generator creates Hash-based Message Authentication Codes from a message and a secret key. It supports SHA-256, SHA-512, and SHA-1 hash algorithms. HMAC is used to verify both the integrity and authenticity of a message. All processing happens in the browser using the Web Crypto API.
How does HMAC Generator work?
This tool uses the browser's SubtleCrypto API to compute HMAC signatures. It takes a message and a secret key, applies the selected hash algorithm, and outputs the signature as a hexadecimal string.
Key Features
- HMAC-SHA256, HMAC-SHA512, HMAC-SHA1
- Text and file input
- Hexadecimal and Base64 output
- Copy signature to clipboard
- Uses Web Crypto SubtleCrypto for signature computation
- Real-time generation
- Web Crypto API based
- Supports any message length
Common Use Cases
Signing API requests
Generate HMAC signatures for API authentication headers like AWS Signature or GitHub webhooks.
Verifying webhook payloads
Compute the expected HMAC for a webhook body to verify it came from the claimed sender.
Creating message authentication codes
Generate HMAC values to prove that a message has not been tampered with.
Debugging API integrations
Compare your computed HMAC with the expected value to troubleshoot authentication failures.
How to Use This Tool
Enter the message
Type or paste the message to sign.
Enter the secret key
Type the secret key used for signing.
Select algorithm
Choose SHA-256, SHA-512, or SHA-1.
Generate
Click Generate. The tool produces the HMAC signature.
Pro Tips
- 1
HMAC-SHA256 is the most commonly used variant for API authentication.
- 2
The secret key should be kept confidential. Anyone with the key can forge signatures.
- 3
HMAC differs from a plain hash because it uses a secret key.
- 4
Many APIs expect hex output, but some expect Base64.
Frequently Asked Questions
What is HMAC?
HMAC generator creates a Hash-based Message Authentication Code by combining a hash function with a secret key to verify message integrity and authenticity.
How is HMAC different from a regular hash?
A regular hash only verifies integrity. HMAC adds authentication because only someone with the secret key can produce the correct signature.
Is my data sent to a server?
No. All computation happens in your browser using the Web Crypto API. Nothing is transmitted.
Which algorithm should I use?
HMAC-SHA256 is the standard for most APIs. Use SHA-512 for higher security requirements.
Can I hash files?
Yes. Upload a file to generate an HMAC for its contents.