HMAC Generator
Generate an HMAC signature for any message using a secret key and SHA-256, SHA-1 or SHA-512. Free, instant and private — everything is computed locally in your browser with the Web Crypto API.
How to use the HMAC generator
- Enter your message. Type or paste the text, payload or request body you want to sign into the message box.
- Add a secret key. Enter the shared secret both sides of the exchange know. The same key must be used to generate and to verify the signature.
- Pick an algorithm and copy. Choose SHA-256, SHA-1 or SHA-512, switch between hex and Base64 output, then copy the resulting HMAC — it updates instantly as you type.
About this tool
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to prove both the integrity and the authenticity of a message. It is the mechanism behind webhook signature verification (Stripe, GitHub, Shopify and many others), signed API requests, JWT tokens using the HS256/HS384/HS512 algorithms, and tamper-evident cookies. Because the signature depends on a key that only the sender and receiver share, an attacker cannot forge a valid HMAC without knowing that key.
This generator runs entirely in your browser using the built-in Web Crypto API — your message and secret key are never uploaded, logged or stored anywhere, so it is safe for real production secrets. Remember that HMAC is a keyed hash, not encryption: it authenticates a message but does not hide its contents, and it is deterministic, meaning the same message and key always produce the same signature.
Frequently asked questions
What is the difference between HMAC and a plain hash?
A plain hash such as SHA-256 can be computed by anyone, so it only detects accidental corruption. HMAC mixes in a secret key, so only someone who knows the key can produce or verify the signature — that is what makes it useful for authentication.
Which hash algorithm should I choose?
SHA-256 is the modern default and the right choice for almost all use cases. SHA-512 produces a longer signature and is slightly stronger. SHA-1 is considered legacy and should only be used when an existing system requires it for compatibility.
What is the difference between hex and Base64 output?
Both encode exactly the same signature bytes; they are just two ways of writing them as text. Hex is common in documentation and logs, while Base64 is more compact and is often used in HTTP headers and JSON.
Is my secret key sent to a server?
No. The HMAC is calculated locally with the Web Crypto API. Nothing you type — message or key — ever leaves your browser, so the tool is safe to use with real credentials.