HMAC Generator
Generate an HMAC (hash-based message authentication code) from a message and a secret key. HMAC is used to verify both the integrity and authenticity of data, such as signing webhooks and API requests.
About this tool
Generate an HMAC (hash-based message authentication code) from a message and a secret key. HMAC is used to verify both the integrity and authenticity of data, such as signing webhooks and API requests.
Example
Input: message + key
Output: a hex HMAC signature
Privacy
This tool runs entirely in your browser. Your data is processed locally and never uploaded to a server.
How to use this tool
- Paste or type the message you want to sign into the message field.
- Enter the secret key exactly as your service expects it, including any spaces or symbols.
- Choose the HMAC algorithm you need, such as SHA-256, SHA-1, or SHA-512.
- Click generate and copy the resulting HMAC signature into your webhook or API verification code.
Step by step, what happens
- The tool reads the message and the secret key as plain text inputs.
- It uses the selected hash algorithm to combine the message with the key and produce an HMAC signature.
- It returns the signature immediately so you can compare it with the value from a webhook, API request, or test payload.
- If you change the message, key, or algorithm, the output changes and you can quickly verify which value matches.
Worked example
Suppose you need to sign a webhook payload that contains a short order status message.
Input: order=1234&status=paid
- Paste the payload string into the message field.
- Enter your shared secret key, for example webhook-secret, and choose SHA-256.
- Generate the HMAC and use the result as the signature you send or compare against.
Output: The exact HMAC depends on the secret key and algorithm you choose, so the tool outputs a different signature for each combination.
Tips and common mistakes
- Use the exact same message bytes that were sent over the wire, because even a small spacing change produces a different HMAC.
- Make sure the key matches what your server or provider uses, and check for hidden spaces when copying it.
- Choose the same algorithm on both sides, since SHA-256, SHA-1, and SHA-512 all produce different signatures.
- If a signature check fails, compare the raw payload first, then the key, then the algorithm.
Frequently asked questions
What is HMAC?
HMAC combines a secret key with a hash function to produce a signature that proves a message came from someone who knows the key and was not modified.
Where is HMAC used?
Webhook signing (Stripe, GitHub), API authentication, and verifying tokens.
Which hash should I use?
SHA-256 is the common default; use SHA-512 for extra strength if the receiver supports it.
More Developer Tools Tools
Explore related calculators in this category
.htaccess Generator
Generate common .htaccess rules, force HTTPS, www redirect, and caching, with checkboxes.
API Key Generator
Generate random, secure API keys and tokens with an optional prefix. Cryptographically secure.
Bcrypt Hash Generator
Generate bcrypt password hashes in your browser with a configurable cost factor. Free online bcrypt tool.
CSRF Token Generator
Generate cryptographically secure random CSRF tokens for forms and APIs.
You Might Also Like
Popular tools from other categories
Barcode Generator
Generate Code 128 / EAN barcodes from your data.
Color Palette Generator
Generate a harmonious color palette from one base color.
Generator Sizing Calculator
Estimate generator kW needed for your loads.
Hashtag Generator
Generate relevant hashtags from a topic keyword.
Can't Find the Right Calculator?
Try our AI Math Solver, type any problem in plain English and get instant step-by-step solutions.