Skip to content

HMAC Generator

Generate and verify HMAC message authentication codes with SHA-256, SHA-512 and more. Secure API signing and data integrity tool.

Updated

What is the HMAC Generator?

Generate secure HMAC (Hash-based Message Authentication Codes) instantly in your browser.

This free online tool lets you create and verify cryptographic signatures using industry-standard algorithms like SHA-256 and SHA-512. Perfect for API authentication, webhook verification, and ensuring message integrity.

Key features:

  • Multiple hash algorithms (SHA-1, SHA-256, SHA-384, SHA-512)
  • Text or hex input support
  • Hex and Base64 output formats
  • Built-in signature verification
  • 100% client-side — your keys never leave your device

How it works

HMAC combines a secret cryptographic key with a hash function to produce a fixed-size message authentication code.

The Process

  1. Prepare inputs: Provide a secret key and the message (payload).
  2. Key padding: The key is processed and combined with the message using inner and outer padding (ipad/opad) per the HMAC specification (RFC 2104).
  3. Hash computation: The combined data is hashed using the selected algorithm (e.g., SHA-256).
  4. Output: The resulting HMAC is encoded as hex or base64.

Why HMAC?

Unlike plain hashes, HMAC provides both integrity (message wasn't altered) and authentication (came from someone with the shared secret). It resists length-extension attacks that affect simple constructions like hash(key + message).

This tool uses the browser's secure Web Crypto API for fast, native computation.

Examples

API Webhook Signature

Generate HMAC for verifying a Stripe or GitHub webhook payload.

Key: webhook_secret123
Message: {"event":"payment.succeeded"}
a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0

Simple Message Authentication

HMAC-SHA256 for message integrity check.

Key: mysecretkey
Message: Hello, secure world!
5d41402abc4b2a76b9719d911017c592

Frequently asked questions

What is HMAC?

HMAC stands for Hash-based Message Authentication Code. It is a type of message authentication code that uses a cryptographic hash function combined with a secret key to verify both the integrity and authenticity of a message.

Which algorithms does the HMAC generator support?

The tool supports SHA-1, SHA-256, SHA-384, and SHA-512. SHA-256 is recommended for most modern applications due to its strong security and performance balance.

How do I verify a webhook signature?

Enter the same secret key and exact payload used by the service, generate the HMAC, then paste the expected signature into the verify field. The tool will confirm if they match.

Is my data secure when using this tool?

Yes. All computations happen entirely in your browser using the Web Crypto API. Your secret keys and messages are never sent to any server.

What is the difference between Hex and Base64 output?

Hex is a human-readable hexadecimal string (common for debugging). Base64 is more compact and frequently used in HTTP headers and API payloads.

Can I use this tool for production API signing?

Yes, for testing and verification. For server-side production use, use native libraries like Node.js crypto or Python hmac to avoid exposing secrets in the browser.

Why does the tool support hex input mode?

Hex mode allows you to input binary data (e.g., raw bytes from files or network packets) directly as hexadecimal strings for accurate signature generation.

What should I do if verification fails?

Ensure the key, message (including whitespace/encoding), algorithm, and output format exactly match the expected values. Even a single character difference will produce a different HMAC.

Related tools

More utilities you might find handy.

Security

API Key Generator

Generate cryptographically secure API keys, tokens, and secrets in your browser. Hex, Base62, Base64URL, UUID, custom charset, prefixes, and bulk export.
Security

Bcrypt Hash Generator

Generate and inspect bcrypt password hashes locally in your browser.
Security

CRC32 Generator

Instantly generate CRC32, CRC32C, BZIP2, MPEG-2 and other checksums for text, files, hex or Base64 – 100% client-side.