HMAC Generator
Generate an HMAC (Hash-based Message Authentication Code) from a message and secret key, using SHA-1, SHA-256, SHA-384, or SHA-512.
Recommended Settings
Pro Tips
- •Unlike a plain hash, HMAC requires the same secret key to reproduce the same output - this is what lets a recipient verify a message came from someone who knows the shared secret
- •SHA-256 is the most commonly used algorithm for HMAC today, including in most webhook signature schemes (like Stripe and GitHub)
- •Both hex and Base64 encodings are shown, since different systems expect different formats for the signature
- •Keep your secret key private - anyone with the key can generate valid signatures, defeating the purpose of verification
Most Popular
Most developers use HMAC-SHA256, the standard for verifying webhook payloads from services like Stripe and GitHub
When to Use This Tool
Compute the expected HMAC signature to verify an incoming webhook payload wasn't tampered with.
Generate a signature for authenticating requests to an API that uses HMAC-based authentication.
Confirm a message hasn't been altered by a party who doesn't know the shared secret.
Manually compute an HMAC to troubleshoot why a signature verification is failing in your code.
How It Works
Import your secret key for use with the HMAC algorithm you select
Sign your message using that key via the Web Crypto API's HMAC implementation
Display the resulting authentication code in both hex and Base64 formats
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Web Crypto API (SubtleCrypto HMAC) for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
What's the difference between a hash and an HMAC?
A plain hash only depends on the input message, so anyone can compute it. An HMAC also incorporates a secret key, so only someone who knows that key can generate or verify a matching HMAC - this is what enables authentication.
Which algorithm should I use?
HMAC-SHA256 is the most widely used choice today and is what most modern webhook and API signing schemes expect, unless a specific service documents a different requirement.
Is my data sent to a server?
No. The HMAC is computed entirely in your browser using the Web Crypto API.
Why does my computed HMAC not match what I expected?
Double-check that your message, key, and algorithm exactly match what the other system used - even a trailing space or newline character in the message will produce a completely different result.
Can I use HMAC-MD5?
This tool doesn't offer HMAC-MD5 since MD5 is considered weak - if you specifically need it for legacy compatibility, you'd need a dedicated MD5-based HMAC implementation.