Skip to main content

HMAC Generator

Generate an HMAC (hash-based message authentication code) from a message and a secret key. HMAC is used to verify both the integrity and authenticity of data, such as signing webhooks and API requests.

Reviewed for accuracy by the Math Ora X team Last updated

About this tool

Generate an HMAC (hash-based message authentication code) from a message and a secret key. HMAC is used to verify both the integrity and authenticity of data, such as signing webhooks and API requests.

Example

Input: message + key

Output: a hex HMAC signature

Privacy

This tool runs entirely in your browser. Your data is processed locally and never uploaded to a server.

How to use this tool

  1. Paste or type the message you want to sign into the message field.
  2. Enter the secret key exactly as your service expects it, including any spaces or symbols.
  3. Choose the HMAC algorithm you need, such as SHA-256, SHA-1, or SHA-512.
  4. Click generate and copy the resulting HMAC signature into your webhook or API verification code.

Step by step, what happens

  1. The tool reads the message and the secret key as plain text inputs.
  2. It uses the selected hash algorithm to combine the message with the key and produce an HMAC signature.
  3. It returns the signature immediately so you can compare it with the value from a webhook, API request, or test payload.
  4. If you change the message, key, or algorithm, the output changes and you can quickly verify which value matches.

Worked example

Suppose you need to sign a webhook payload that contains a short order status message.

Input: order=1234&status=paid

  1. Paste the payload string into the message field.
  2. Enter your shared secret key, for example webhook-secret, and choose SHA-256.
  3. Generate the HMAC and use the result as the signature you send or compare against.

Output: The exact HMAC depends on the secret key and algorithm you choose, so the tool outputs a different signature for each combination.

Tips and common mistakes

  • Use the exact same message bytes that were sent over the wire, because even a small spacing change produces a different HMAC.
  • Make sure the key matches what your server or provider uses, and check for hidden spaces when copying it.
  • Choose the same algorithm on both sides, since SHA-256, SHA-1, and SHA-512 all produce different signatures.
  • If a signature check fails, compare the raw payload first, then the key, then the algorithm.

Frequently asked questions

What is HMAC?

HMAC combines a secret key with a hash function to produce a signature that proves a message came from someone who knows the key and was not modified.

Where is HMAC used?

Webhook signing (Stripe, GitHub), API authentication, and verifying tokens.

Which hash should I use?

SHA-256 is the common default; use SHA-512 for extra strength if the receiver supports it.

Facebook Twitter WhatsApp