HMAC Generator

Generate secure HMAC signatures using MD5, SHA-1, SHA-256, or SHA-512.

Whenever possible, your data never leaves your device. Your security is our priority.

Live HMAC Signer

Message (Payload)

Secret Key

Algorithm

Format

Uppercase Output

HMAC Signature

About this Tool

HMAC (Hash-based Message Authentication Code) is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key. It is used to simultaneously verify both the data integrity and the authenticity of a message.

HMACs are widely used in modern web APIs (like Stripe, AWS, and GitHub webhooks) to securely sign requests. By using a secret key known only to the sender and receiver, it prevents "man-in-the-middle" attackers from tampering with the payload.

How to Use

Enter Data and Key

Provide the plaintext message (payload) and the secret key. Both are required to generate an HMAC signature.

Select Algorithm

Choose the hashing algorithm. HMAC-SHA256 is the modern standard for most web APIs and webhooks.

Format and Copy

Select between Hexadecimal or Base64 output formatting depending on your API requirements, then copy the result.

Frequently Asked Questions

Standard hashes (like regular SHA-256) only verify that data hasn't changed. HMAC uses a secret key to also prove *who* sent the data, ensuring the message came from an authorized sender who possesses the secret key.

Hex outputs the hash as a string of numbers and letters (0-9, a-f). Base64 outputs a shorter, denser string including uppercase, lowercase, and special characters (+, /, =). Check your API documentation to see which format they expect.

Yes. All computations are performed strictly in your browser using client-side JavaScript. Your secret keys and payloads are never sent over the network or logged.