HMAC Generator

Generate HMAC (Hash-based Message Authentication Code) signatures using HMAC-MD5, HMAC-SHA1, HMAC-SHA256, and HMAC-SHA512. Perfect for API signatures, webhook verification, and message authentication. 100% client-side — your secret key never leaves your device.

Message
Secret Key
HMAC Algorithm
Output Format

Enter a message and secret key, then click Generate...

About HMAC Generator

HMAC (Hash-based Message Authentication Code) is a specific construction for creating a message authentication code using a cryptographic hash function combined with a secret key. It provides both data integrity and authenticity verification. HMAC is widely used in API authentication (like AWS Signature, Stripe webhooks), JWT signing, and secure message exchange. This tool generates HMAC signatures entirely in your browser using the Web Crypto API — your secret key is never transmitted to any server.

Features

How to Use

  1. Enter your message or payload in the Message field
  2. Enter your secret key in the Secret Key field
  3. Select the HMAC algorithm that matches your use case
  4. Choose your preferred output format (hex or base64)
  5. Click Generate HMAC to compute the signature
  6. Copy the result and use it in your API request, webhook, or authentication flow

Quick Examples

Frequently Asked Questions

What is HMAC and why do I need it?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a unique signature for a message. It verifies both data integrity (the message has not been altered) and authenticity (the sender possesses the secret key). HMAC is essential for API authentication, webhook verification, and secure communications.

Which HMAC algorithm should I use?

HMAC-SHA256 is the most widely recommended choice for general use — it provides strong security and is supported by virtually all platforms. HMAC-SHA512 offers even greater security with a longer output. HMAC-SHA1 is still used in legacy systems but is gradually being phased out. HMAC-MD5 is included for compatibility with older systems but should not be used for new security-critical applications.

Is my secret key safe?

Yes. All HMAC computation happens entirely within your browser using the Web Crypto API. Your secret key is never sent to any server, logged, or stored. Once you close or refresh the page, the key is gone. However, always exercise caution when entering production secrets in any web-based tool.

What is the difference between hex and base64 output?

Hexadecimal output represents the HMAC value as a string of hexadecimal characters (0-9, a-f). Base64 output encodes the same binary data using a more compact ASCII representation. Hex is commonly used in API documentation and logs, while Base64 is often preferred for embedding in URLs, headers, and JSON payloads. Both represent the exact same signature.

How is HMAC used in API authentication?

Many APIs (including AWS, Stripe, and Twilio) use HMAC to sign API requests. The client generates an HMAC signature of the request using a secret API key and includes the signature in the request headers. The server independently computes the same signature using its copy of the secret key. If the signatures match, the request is authenticated and its integrity is verified.

Can I use this for JWT token signing?

Yes. JWT tokens using the HS256, HS384, or HS512 algorithms are signed with HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 respectively. This tool can help you verify or generate the signature portion of a JWT by encoding the header and payload as the message and using the JWT secret as the key.

Why does my HMAC not match the API's expected value?

Common reasons for mismatched HMAC values include: (1) Different encoding of the message or key (UTF-8 vs ASCII), (2) Extra whitespace or newline characters, (3) Different HMAC algorithm specified, (4) Message constructed in a different order than expected by the API. Always verify the exact message format and encoding requirements from the API documentation.