HMAC Generator Online
Generate HMAC signatures using SHA-1, SHA-256, or SHA-512. Output in hex and Base64. Free, private, browser-based.
How to Use
- 1. Select the hashing algorithm (SHA-1, SHA-256, or SHA-512).
- 2. Enter the message you want to authenticate.
- 3. Enter your secret key.
- 4. Click Generate HMAC to compute the signature.
- 5. Copy the HMAC in hex or Base64 format.
About This Tool
HMAC (Hash-based Message Authentication Code) is a widely used mechanism for message authentication in secure communications. It's used in HTTPS, API authentication, webhook signature verification, and many other security protocols.
Unlike a simple hash, HMAC requires a secret key. This means that even if an attacker knows the algorithm and message, they cannot compute the correct HMAC without the key. This property makes HMAC suitable for verifying that a message came from a trusted source and wasn't tampered with.
HMAC-SHA-256 is the most commonly used variant. It's used in AWS Signature Version 4, JWT with the HS256 algorithm, OAuth 1.0, and webhook signatures from services like GitHub, Stripe, and Shopify. HMAC-SHA-512 provides a higher security margin and is preferred in high-security contexts.
This tool uses the browser's native Web Crypto API (crypto.subtle.sign) to compute HMAC signatures. The computation is performed in your browser — your message and secret key are never transmitted to any server.
The output is provided in both hexadecimal (lowercase hex string) and Base64 formats, as different APIs and protocols use different conventions. For example, GitHub webhook signatures use hex format prefixed with "sha256=", while many JWT implementations use Base64url.
You may also find our Hash Generator, JWT Decoder, and Text Encrypt / Decrypt helpful.
Frequently Asked Questions
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a mechanism for message authentication using a cryptographic hash function combined with a secret key. It verifies both data integrity and authenticity.
What is the difference between HMAC and a hash?
A regular hash (like SHA-256) only verifies data integrity — anyone can compute it. HMAC adds a secret key, so only parties who know the key can generate or verify the HMAC. This proves the message came from a trusted source.
Which algorithm should I use?
HMAC-SHA-256 is the recommended choice for most applications. It offers a good balance of security and performance. HMAC-SHA-512 provides a higher security margin. HMAC-SHA-1 is considered legacy.
What is the output format?
The tool outputs the HMAC in two formats: hexadecimal (lowercase hex characters) and Base64 (URL-safe base64 encoding). Many APIs use one or the other depending on their convention.
Is my secret key safe?
Yes. All computation happens in your browser using the Web Crypto API. Your message and secret key are never sent to any server.
Was this tool helpful?
More Tools
Related Security
QR Code Generator
Password Generator
Hash Generator
JWT Decoder
You Might Also Like