HMAC Generator
Generate keyed HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 entirely in your browser. Perfect for webhook verification, API request signing, secret-based integrity checks, and authentication debugging.
Complete Guide: HMAC Generator
Everything you need to know about using this tool effectively
The HMAC Generator creates Hash-based Message Authentication Codes from a message and a secret key. It supports SHA-256, SHA-512, and SHA-1 hash algorithms. HMAC is used to verify both the integrity and authenticity of a message. All processing happens in the browser using the Web Crypto API.
This tool uses the browser's SubtleCrypto API to compute HMAC signatures. It takes a message and a secret key, applies the selected hash algorithm, and outputs the signature as a hexadecimal string.
Signing API requests
Generate HMAC signatures for API authentication headers like AWS Signature or GitHub webhooks.
Verifying webhook payloads
Compute the expected HMAC for a webhook body to verify it came from the claimed sender.
Creating message authentication codes
Generate HMAC values to prove that a message has not been tampered with.
Debugging API integrations
Compare your computed HMAC with the expected value to troubleshoot authentication failures.
Enter the message
Type or paste the message to sign.
Enter the secret key
Type the secret key used for signing.
Select algorithm
Choose SHA-256, SHA-512, or SHA-1.
Generate
Click Generate. The tool produces the HMAC signature.
HMAC-SHA256 is the most commonly used variant for API authentication.
The secret key should be kept confidential. Anyone with the key can forge signatures.
HMAC differs from a plain hash because it uses a secret key.
Many APIs expect hex output, but some expect Base64.
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature that verifies both message integrity and authenticity.
How is HMAC different from a regular hash?
A regular hash only verifies integrity. HMAC adds authentication because only someone with the secret key can produce the correct signature.
Is my data sent to a server?
No. All computation happens in your browser using the Web Crypto API. Nothing is transmitted.
Which algorithm should I use?
HMAC-SHA256 is the standard for most APIs. Use SHA-512 for higher security requirements.
Can I hash files?
Yes. Upload a file to generate an HMAC for its contents.