HMAC Generator
This HMAC generator computes a keyed hash message authentication code from any m
This HMAC generator computes a keyed hash message authentication code from any m
How to use HMAC Generator
- Enter the message you want to sign and paste your secret key.
- Choose the key encoding (Text, Hex, or Base64) and the hash algorithm such as SHA-256.
- Copy the generated HMAC in hex or Base64 for your header, webhook, or API request.
About HMAC Generator
This HMAC generator computes a keyed hash message authentication code from any message and a shared secret key. It supports HMAC-SHA256, HMAC-SHA1, HMAC-SHA384, and HMAC-SHA512, and outputs the result in both hexadecimal and Base64 so you can drop it straight into a request header, webhook signature, or API call.
Your secret key can be entered as plain text (UTF-8), hex, or Base64 — useful when a provider gives you a key in a specific encoding. The tool recomputes the signature instantly as you type and shows a clear error if a hex or Base64 key is malformed, so you never sign with a silently mangled key.
Everything runs locally using your browser's built-in Web Crypto API. Your message and secret key are never uploaded or logged — the computation happens entirely on your device, which matters because HMAC secrets are sensitive credentials.
Frequently asked questions
- What is an HMAC and what is it used for?
- HMAC (Hash-based Message Authentication Code) combines a message with a secret key to produce a signature that proves the message came from someone who knows the key and was not altered in transit. It is widely used for webhook verification, API request signing, and validating tokens.
- Which hash algorithms does this support?
- HMAC-SHA256, HMAC-SHA1, HMAC-SHA384, and HMAC-SHA512. SHA-256 is the most common default; SHA-1 is included because some older webhook and payment systems still require HMAC-SHA1.
- Is my secret key sent anywhere?
- No. The signature is computed entirely in your browser with the Web Crypto API. Your message and key never leave your device and are not stored or transmitted.
- Why do I need to pick a key encoding?
- Providers issue secret keys in different formats. If your key is a normal passphrase, use Text (UTF-8). If it was given as a hex or Base64 string, choose that encoding so the raw key bytes match exactly — otherwise the signature will not match the provider's.
- Will this output match my server or library?
- Yes, as long as the message text, key bytes, key encoding, and hash algorithm are identical. It uses the same standard HMAC defined in RFC 2104 that libraries like Node crypto, Python hmac, and OpenSSL implement. Note that messages are treated as UTF-8 text here.
- What is the difference between the hex and Base64 output?
- They are two encodings of the exact same signature bytes. Hex is common in headers and documentation; Base64 is shorter and used by some APIs. Copy whichever format your integration expects.