HMAC signature appears here
Enter a message and secret key above// generate HMAC signatures with any algorithm and key
Generate HMAC signatures using SHA-256, SHA-384, SHA-512, SHA-1, or MD5 — with message and secret key. Multiple output encodings. Browser-based, free, no signup.
HMAC signature appears here
Enter a message and secret key aboveSelect HMAC-SHA256 (most common), HMAC-SHA512, or one of the other variants. The algorithm determines the output length and security properties.
Type or paste the message to sign and the secret key. Both support UTF-8, hex, or base64 encoding. The HMAC is computed live as you type.
Choose output format (hex, base64, or base64url) and copy the HMAC. Enable "Verify HMAC" to compare against a known value.
HMAC (Hash-based Message Authentication Code) uses a secret key combined with a hash function to produce a signature that proves both the integrity and authenticity of a message. This tool computes HMAC using the browser's native Web Crypto API — your message and key never leave your browser.
HMAC is used to verify that a message both came from a trusted sender (who knows the secret key) and has not been tampered with in transit. Common uses include: API request signing (AWS Signature v4, Stripe webhooks), webhook verification (GitHub, Shopify), secure URL generation, and cookie/session integrity checks. Any system where two parties share a secret and need to authenticate messages uses HMAC.
A regular hash (SHA-256, MD5) takes only the message as input — anyone with the message can compute the same hash. HMAC takes both the message and a secret key — only someone with the key can produce the correct signature. This means an attacker who intercepts the message cannot forge a valid HMAC without knowing the key. Regular hashes provide integrity only; HMAC provides integrity plus authentication.
Choose based on what your receiving system expects. Hex (a3f2...) is human-readable and commonly used in API headers and logging. Base64 is more compact (roughly 33% shorter than hex) and often required for HTTP headers with binary data. Base64url is Base64 without +// characters — safe for use in URLs and JWT tokens without percent-encoding.
The key can be entered as a plain UTF-8 string (most common for API keys like mysecretkey), as a hexadecimal string (for binary keys stored as hex), or as a base64 string (for binary keys stored as base64, common in AWS and cloud platforms). Choose the encoding that matches how your key is stored or provided.
Yes. All HMAC computation happens entirely in your browser using the native Web Crypto API. Your message and key are not sent to any server, not stored anywhere, and not logged. The browser's Web Crypto implementation is sandboxed and cryptographically sound. As a general security practice, avoid using production keys in third-party tools — use a test key during development.
GitHub signs webhook payloads with HMAC-SHA256 using your webhook secret. The signature is sent in the X-Hub-Signature-256 header as sha256=<hex>. To verify: paste the raw request body as the message (UTF-8), enter your webhook secret as the key (UTF-8), select HMAC-SHA256, set output to hex, and compare with the value after sha256= in the header. Enable Verify mode for instant comparison.
HMAC is the foundation of authenticated communication on the web. Every time a platform like Stripe, GitHub, Shopify, Twilio, or AWS sends a webhook, it includes an HMAC signature computed from the payload and a shared secret. Your server verifies this signature before processing the event. This tool lets you compute and verify those signatures without writing code.
Webhook providers use HMAC to prove that a webhook request came from them and not an attacker. The flow is: the provider computes HMAC(secret, payload) and sends it in a header. Your server computes the same HMAC and compares — if they match, the payload is authentic. This tool helps you test and debug this flow during integration by computing the expected signature for any payload.
JWT tokens using HS256 are actually HMAC-SHA256 applied to the base64url-encoded header and payload. The key difference is that JWTs are a structured format (three dot-separated parts) while HMAC is a general-purpose primitive. When you generate a HS256 JWT, your signing library is computing HMAC-SHA256 over the header.payload string. This tool computes raw HMAC for any arbitrary message and key.