Skip to content

HMAC Generator

Generate or verify HMAC values for local testing with SHA-1, SHA-256, SHA-384, or SHA-512.

Updated

What is the HMAC Generator?

Generate or verify HMAC (Hash-based Message Authentication Code) values in your browser.

Use it to check a message and signature when you know the shared secret and exact input format. For production signing, keep secrets in your server-side application or a trusted secrets manager.

Key features:

  • Multiple hash algorithms (SHA-1, SHA-256, SHA-384, SHA-512)
  • Text or hex input support
  • Hex and Base64 output formats
  • Built-in signature verification
  • Calculations run in your browser; protect the device and avoid shared or untrusted computers

How it works

HMAC combines a secret cryptographic key with a hash function to produce a fixed-size message authentication code.

The Process

  1. Prepare inputs: Provide a secret key and the message (payload).
  2. Key padding: The key is processed and combined with the message using inner and outer padding (ipad/opad) per the HMAC specification (RFC 2104).
  3. Hash computation: The combined data is hashed using the selected algorithm (e.g., SHA-256).
  4. Output: The resulting HMAC is encoded as hex or base64.

Why HMAC?

Unlike plain hashes, HMAC provides both integrity (message wasn't altered) and authentication (came from someone with the shared secret). It resists length-extension attacks that affect simple constructions like hash(key + message).

The tool uses the browser's Web Crypto API. Select the same algorithm, key bytes, message bytes, and encoding used by the system you are checking. Do not expose a production secret in an untrusted browser session.

Examples

API Webhook Signature

Generate HMAC for verifying a Stripe or GitHub webhook payload.

Key: webhook_secret123
Message: {"event":"payment.succeeded"}
 
2ceac728e88c4b2930d8bb1165f29ab72921223fee60fc9f8fc8e101e342a00e

Simple Message Authentication

HMAC-SHA256 for message integrity check.

Key: mysecretkey
Message: Hello, secure world!
 
056ef2d87face5efa1747175902d42406c5d632ad8e80314fddf263e3c9e599b

Frequently asked questions

What is HMAC?

HMAC stands for Hash-based Message Authentication Code. It is a type of message authentication code that uses a cryptographic hash function combined with a secret key to verify both the integrity and authenticity of a message.

Which algorithms does the HMAC generator support?

The tool supports SHA-1, SHA-256, SHA-384, and SHA-512. Choose the algorithm required by the protocol or service; SHA-256 is a common choice for new applications.

How do I verify a webhook signature?

Enter the same secret key and exact payload used by the service, generate the HMAC, then paste the expected signature into the verify field. The tool will confirm if they match.

Is my data secure when using this tool?

The calculation runs in your browser using the Web Crypto API. Do not enter production secrets into a shared or untrusted device or browser session.

What is the difference between Hex and Base64 output?

Hex is a human-readable hexadecimal string (common for debugging). Base64 is more compact and frequently used in HTTP headers and API payloads.

Can I use this tool for production API signing?

Use this tool for local testing or verification with non-production secrets. For production signing, use a server-side library and keep the key out of browser code.

Why does the tool support hex input mode?

Hex mode allows you to input binary data (e.g., raw bytes from files or network packets) directly as hexadecimal strings for accurate signature generation.

What should I do if verification fails?

Ensure the key, message (including whitespace/encoding), algorithm, and output format exactly match the expected values. Even a single character difference will produce a different HMAC.

Related tools

More utilities you might find handy.

Security

API Key Generator

Generate random strings for application secrets or testing, with selectable formats, prefixes, and bulk export.
Security

Bcrypt Format Demo

Inspect bcrypt-like string structure and demonstrate a non-interoperable password-hash format.
Security

CRC32 Generator

Instantly generate CRC32, CRC32C, BZIP2, MPEG-2 and other checksums for text, files, hex or Base64 – 100% client-side.