HMAC Generator
Generate HMAC signatures with SHA-256, SHA-1, SHA-384 or SHA-512. Enter a message and secret, get hex and Base64 output. Web Crypto, fully in-browser.
About the HMAC Generator
This HMAC generator computes keyed hash message authentication codes for verifying webhooks, signing API requests and checking data integrity. Enter your message and secret key, pick a hash algorithm, and get the signature in both hexadecimal and Base64 encodings.
It uses the browser's built-in Web Crypto API, so the HMAC is calculated with a properly vetted cryptographic implementation rather than hand-rolled code. Message and key are UTF-8 encoded before signing, matching how servers and libraries compute HMACs, so the output lines up with what your backend produces.
Choose HMAC-SHA256 (the standard for webhook signatures from Stripe, GitHub and many others), or SHA-384/SHA-512 for stronger digests, or SHA-1 only when verifying legacy systems. Everything runs locally in your browser — the secret never leaves your device — making it safe for real signing keys during development and debugging.
How to Use the HMAC Generator
- 1Enter the message or payload you want to sign.
- 2Enter the shared secret key.
- 3Choose the hash algorithm (SHA-256 is the usual choice).
- 4Click Generate HMAC and copy the hex or Base64 output.
Frequently Asked Questions
What's the difference between an HMAC and a plain hash?
A plain hash like SHA-256 depends only on the message, so anyone can compute it. An HMAC also mixes in a secret key, so only parties who know the key can produce or verify the signature. That's what makes HMAC suitable for authenticating webhooks and API requests.
Why do webhook providers use HMAC-SHA256?
When a service like Stripe or GitHub sends you a webhook, it signs the payload with a shared secret using HMAC-SHA256 and includes the signature in a header. You recompute the HMAC on your side and compare — if they match, the request genuinely came from the provider and wasn't tampered with.
Should I ever use HMAC-SHA1?
Only for compatibility with older systems that still require it. SHA-1 is weakened for collision resistance, so for anything new choose HMAC-SHA256 or stronger. The option is provided so you can verify existing legacy signatures.
Is my secret key safe to enter here?
Yes. The message and key are processed locally by the Web Crypto API in your browser and are never transmitted or logged. That said, for production secrets you should still be mindful of your environment — this tool is designed for development, testing and verification.