HMAC (Hash-based Message Authentication Code) combines a message with a secret key to produce a signature that proves both integrity and authenticity. This tool generates HMAC signatures using your chosen hash algorithm, computed locally with the Web Crypto API.
How to use it
- Enter your message.
- Enter the secret key.
- Choose a hash algorithm (SHA-256 is most common).
- The HMAC signature appears instantly. Copy it.
About HMAC Generator
HMAC is everywhere in API security: webhook signatures, request signing (like AWS), and token verification all rely on it. Unlike a plain hash, HMAC needs a shared secret, so only parties holding the key can produce or verify the signature — proving the message was not tampered with and came from a trusted source. Use this to test webhook verification or to understand how a signing scheme works. The key and message never leave your browser.
FAQ
How is HMAC different from a hash?
A hash needs no key and only proves integrity. HMAC mixes in a secret key, so it also proves the message came from someone holding that key.
Which algorithm should I use?
HMAC-SHA256 is the modern default and what most APIs expect. SHA-1 is legacy; SHA-384/512 offer longer outputs.
Is my secret uploaded?
No. The signature is computed entirely in your browser.