HMAC Generator
Generate HMAC-SHA1, SHA-256 and SHA-512 signatures
About HMAC Generator
Computes an HMAC for any message and secret key with SHA-1, SHA-256 or SHA-512 and shows the result as lowercase hex, updating as you type. Signing runs through the browser's Web Crypto API. Handy for checking webhook signatures from services such as GitHub or Stripe, or for reproducing API request signing while writing tests.
Category: Encoding.
Frequently asked questions
What is HMAC?
▾
Hash-based Message Authentication Code. It combines a secret key with a cryptographic hash function (SHA-256, SHA-512) to produce a signature that proves both data integrity and authenticity.
How is HMAC different from a plain hash?
▾
A plain hash (SHA-256) can be recomputed by anyone. HMAC requires the secret key — only parties who know the key can generate or verify the signature, preventing forgery.
Why doesn't my HMAC match the signature I expected?
▾
The message must match byte for byte, so a re-serialized JSON body, an extra newline or a missing timestamp prefix changes the result. The output here is hex, while some services send Base64 or add a label such as sha256=, so compare values in the same encoding.
How is the secret key handled?
▾
The key is used exactly as typed, as UTF-8 text, so a stray space changes the result. Secrets issued as hex or Base64 bytes are not decoded first, so decode them in code if your provider expects raw bytes; the key never leaves your browser.