Skip to content
ToolsOnDuty - free online tools
Security & Cryptography

HMAC Generator

Generate an HMAC signature from a message and secret key.

Free foreverRuns in your browserNo sign-up

HMAC is computed locally with the Web Crypto API. Your message and secret are never uploaded.

About the HMAC Generator

Generate a keyed hash message authentication code (HMAC) to sign or verify messages, webhooks and API requests.

Choose SHA-256, SHA-1, SHA-384 or SHA-512, enter your message and secret, and get the signature as hex.

Everything runs in your browser using the Web Crypto API, so your message and secret are never uploaded.

Key features

  • HMAC with SHA-256, SHA-1, SHA-384, SHA-512
  • Hex output ready to compare
  • Updates instantly as you type
  • Runs entirely in your browser

How to use

  1. 1Enter the message you want to sign.
  2. 2Enter the shared secret key and pick an algorithm.
  3. 3Copy the resulting HMAC signature.

Examples

Sign a webhook body
Input: message + secret (SHA-256)
Output: 64-character hex signature

The receiver recomputes the HMAC with the same secret to verify it.

Compare algorithms
Input: same message, SHA-512
Output: 128-character hex signature

A longer hash gives a longer signature.

Frequently asked questions

What is HMAC used for?
HMAC verifies that a message came from someone who knows the secret and was not changed in transit, which is common for webhooks and API signing.
Which algorithm should I use?
HMAC-SHA256 is the usual default. Use SHA-384 or SHA-512 for longer signatures, and SHA-1 only when a system requires it.
Is my data uploaded?
No. The HMAC is computed entirely in your browser.

Related tools