HMAC Generator

HMAC Generator tool

🔒 Runs in your browser · No uploads · Your data never leaves your device

How to use

1. 1

   Enter message and secret key

   Paste the message and secret key. The HMAC is computed automatically as you type.

2. 2

   Choose algorithm and format

   Select SHA-256, SHA-512, SHA-1, or SHA-384. Choose hex, Base64, or Base64url output.

3. 3

   Verify an existing HMAC

   Paste an HMAC into the Verify section to check if it matches your message and key.

Common use cases

• Verifying webhook signatures — Compute HMAC-SHA256 of a webhook payload using the provider's secret to confirm the signature in the X-Hub-Signature or Stripe-Signature header.
• Generating API request signatures — Sign API request bodies or query strings with a shared secret key to authenticate API calls to services that use HMAC-based auth.

Examples

• Verify a webhook signature

  Compute HMAC-SHA256 of a Stripe-like payload.

  Input

  Message: payload body | Key: webhook_secret

  Output

  3ecb2b2c98f2...

Frequently asked questions

Is my secret key safe?

Yes. Everything runs in your browser. The secret key is never sent to any server.

What is the difference between hex and Base64 output?

Both encode the same HMAC bytes. Hex uses 0-9 and a-f characters (longer). Base64 is shorter and commonly used in HTTP headers. Base64url replaces + and / with - and _ for safe URL use.

Why is HMAC better than signing with a private key?

HMAC is faster and simpler for symmetric scenarios where both parties share the same secret. Use asymmetric signing (RSA, Ed25519) when the verifier must not know the signing key.

Key concepts

HMAC

Hash-based Message Authentication Code — a MAC computed using a cryptographic hash function and a secret key, proving both data integrity and authenticity.

Hex encoding

A way to represent binary data as a string of hexadecimal characters (0–9, a–f). HMAC output is typically expressed in hex or Base64.

Related tools

You might find these useful too.

• Hash Generator

  Generate MD5, SHA-1, SHA-256, and SHA-512 hashes instantly.

  Open
• JWT Decoder

  Decode JWT header and payload claims locally in the browser.

  Open
• RSA Key Pair Generator

  Generate RSA key pairs in-browser. 1024, 2048 or 4096 bits. PEM format.

  Open
• Bcrypt Generator

  Hash and verify bcrypt passwords locally in the browser.

  Open

More hashing tools

• TOTP / OTP Generator

  Generate RFC 6238 TOTP codes from a base32 secret with a live countdown.

  Open