HMAC Generator
Generate and verify HMAC message authentication codes with SHA-256, SHA-512 and more. Secure API signing and data integrity tool.
Updated
What is the HMAC Generator?
Generate secure HMAC (Hash-based Message Authentication Codes) instantly in your browser.
This free online tool lets you create and verify cryptographic signatures using industry-standard algorithms like SHA-256 and SHA-512. Perfect for API authentication, webhook verification, and ensuring message integrity.
Key features:
- Multiple hash algorithms (SHA-1, SHA-256, SHA-384, SHA-512)
- Text or hex input support
- Hex and Base64 output formats
- Built-in signature verification
- 100% client-side — your keys never leave your device
How it works
HMAC combines a secret cryptographic key with a hash function to produce a fixed-size message authentication code.
The Process
- Prepare inputs: Provide a secret key and the message (payload).
- Key padding: The key is processed and combined with the message using inner and outer padding (ipad/opad) per the HMAC specification (RFC 2104).
- Hash computation: The combined data is hashed using the selected algorithm (e.g., SHA-256).
- Output: The resulting HMAC is encoded as hex or base64.
Why HMAC?
Unlike plain hashes, HMAC provides both integrity (message wasn't altered) and authentication (came from someone with the shared secret). It resists length-extension attacks that affect simple constructions like hash(key + message).
This tool uses the browser's secure Web Crypto API for fast, native computation.
Examples
API Webhook Signature
Generate HMAC for verifying a Stripe or GitHub webhook payload.
Simple Message Authentication
HMAC-SHA256 for message integrity check.
Frequently asked questions
What is HMAC?
What is HMAC?
HMAC stands for Hash-based Message Authentication Code. It is a type of message authentication code that uses a cryptographic hash function combined with a secret key to verify both the integrity and authenticity of a message.
Which algorithms does the HMAC generator support?
Which algorithms does the HMAC generator support?
The tool supports SHA-1, SHA-256, SHA-384, and SHA-512. SHA-256 is recommended for most modern applications due to its strong security and performance balance.
How do I verify a webhook signature?
How do I verify a webhook signature?
Enter the same secret key and exact payload used by the service, generate the HMAC, then paste the expected signature into the verify field. The tool will confirm if they match.
Is my data secure when using this tool?
Is my data secure when using this tool?
Yes. All computations happen entirely in your browser using the Web Crypto API. Your secret keys and messages are never sent to any server.
What is the difference between Hex and Base64 output?
What is the difference between Hex and Base64 output?
Hex is a human-readable hexadecimal string (common for debugging). Base64 is more compact and frequently used in HTTP headers and API payloads.
Can I use this tool for production API signing?
Can I use this tool for production API signing?
Yes, for testing and verification. For server-side production use, use native libraries like Node.js crypto or Python hmac to avoid exposing secrets in the browser.
Why does the tool support hex input mode?
Why does the tool support hex input mode?
Hex mode allows you to input binary data (e.g., raw bytes from files or network packets) directly as hexadecimal strings for accurate signature generation.
What should I do if verification fails?
What should I do if verification fails?
Ensure the key, message (including whitespace/encoding), algorithm, and output format exactly match the expected values. Even a single character difference will produce a different HMAC.
Related tools
More utilities you might find handy.
API Key Generator
Generate cryptographically secure API keys, tokens, and secrets in your browser. Hex, Base62, Base64URL, UUID, custom charset, prefixes, and bulk export.
Bcrypt Hash Generator
Generate and inspect bcrypt password hashes locally in your browser.
CRC32 Generator
Instantly generate CRC32, CRC32C, BZIP2, MPEG-2 and other checksums for text, files, hex or Base64 – 100% client-side.