HMAC Generator
Generate and verify an HMAC signature with SHA-256, SHA-1, SHA-384 or SHA-512 and your secret key.
Enter a message and a secret key.
How it works
An HMAC (hash-based message authentication code) mixes your message with a secret key before hashing, so only someone who knows the key can produce or check the value. Paste the message, type the shared secret, pick the hash algorithm (HMAC-SHA256 is the common default for webhooks and API request signing) and the signature appears instantly in hex or Base64. If your key is stored as hex or Base64 bytes rather than plain text, switch Key format so the exact same bytes are used — that is the usual reason two tools disagree on the same input.
Paste a signature you received into Verify an existing HMAC and the tool tells you
whether it matches; hex is compared case-insensitively and Base64 is accepted too, so you can
check a webhook header such as X-Hub-Signature-256 without reformatting it. The
HMAC is computed by the browser's built-in Web Crypto API — your key and message stay on your
device, are never uploaded, and nothing is logged or stored.
Frequently asked questions
What is an HMAC and how is it different from a plain hash?
An HMAC (hash-based message authentication code) hashes your message together with a secret key, using a hash function such as SHA-256. A plain hash can be recomputed by anyone, so it only proves the data was not corrupted. An HMAC can only be produced or checked by someone who knows the key, so it also proves who sent the message — which is why APIs and webhooks sign requests with it.
How do I generate an HMAC-SHA256 signature online?
Paste the exact message body into the Message box, type your shared secret into Secret key, leave the algorithm on HMAC-SHA256 and the signature appears immediately. If your key is stored as hex or Base64 bytes rather than plain text, switch Key format to match — using the wrong key format is the most common reason two tools produce different signatures for the same message.
Is it safe to enter my secret key in this HMAC generator?
Yes. The signature is computed entirely in your browser by the built-in Web Crypto API, so the message and the secret key are never sent to a server, logged or stored — unlike most online HMAC generators, which POST both to their backend. For extra certainty you can load the page, go offline, and it will still work.