Loading…
Compute HMAC-SHA256/SHA512 for message authentication. Use for webhook signatures; for plain hashes use hash-generator. Input: message + secret key. Returns hex HMAC. 100% client-side.
HMAC Generator is loading — interactive editor will appear here. Use examples below to try instantly once loaded.
Press ? for keyboard shortcuts
Generates HMAC (Hash-based Message Authentication Code) signatures using Web Crypto API. Supports SHA-1, SHA-256, SHA-384, and SHA-512 algorithms, producing hex-encoded output for any message and secret key combination.
HMAC is essential for API authentication, webhook verification, and message integrity checks. This tool provides a quick browser-based way to compute HMAC signatures without writing code or using command-line tools.
This tool is part of the DevStackIO platform — a collection of free online developer tools from DevStackIO. Browse more free developer resources on DevStackIO.
API developers implementing request signing, backend engineers verifying webhook payloads, and security professionals auditing authentication systems.
Enter the message (data) to be authenticated in the message field
Enter the secret key used for signing
Select the hashing algorithm (SHA-256 is recommended for most use cases)
The hex-encoded HMAC signature appears automatically
Click 'Copy' to copy the signature to your clipboard
Message: 'Hello, World!', Key: 'secret', Algorithm: SHA-256 → Output: hex-encoded 64-character HMACMessage: 'POST /api/webhook', Key: 'whsec_abc123', Algorithm: SHA-512 → Output: hex-encoded 128-character HMACWhat is HMAC? Hash-based Message Authentication Code
a construction that combines a cryptographic hash with a secret key to authenticate messages.
How is HMAC different from a plain hash?
HMAC includes a secret key, so only someone with the key can produce or verify the signature.
Which algorithm should I choose?
SHA-256 is the most widely used; SHA-512 for maximum security; SHA-1 only for legacy compatibility.
Is HMAC the same as a digital signature? No
HMAC uses a symmetric key (shared secret), while digital signatures use asymmetric keys (public/private).
Authoritative specifications, standards, and in-depth reading for HMAC Generator.
About HMAC
HMAC (Hash-based Message Authentication Code) provides both data integrity and authentication using a secret key. It is widely used for API request signing, webhook verification, and token generation.
Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes for text. Copy or compare instantly.
Generate time-based OTP codes from authenticator secret. Use for 2FA testing; for random tokens use token-generator. Input: Base32 secret. Returns 6-digit code + QR. 100% client-side.
Decode SSL certificates (subject/expiry/chain). Use for debugging certs. Input: PEM text ≤10MB. Returns parsed fields. 100% client-side.
Build Content-Security-Policy headers. Use for XSS hardening. Input: directive options. Returns policy string. 100% client-side.
Compute MD5/SHA-256/SHA-512 checksums for files to verify integrity. Use for files; for text strings use hash-generator. Input: file ≤10MB. Returns hex digests. 100% client-side, files never uploaded.
Infer JSON Schema from sample JSON for validation. Use when authoring schemas; for validating instances use json-validator. Input: JSON ≤10MB. Returns JSON Schema draft. 100% client-side.
Hash passwords with bcrypt (cost-configurable) and verify. Use for password storage; for fast checksums use hash-generator, for keyed MACs use hmac-generator. Input: password text. Returns bcrypt hash. 100% client-side.
Generate sortable ULIDs (time-ordered IDs). Use when ordering matters; for random UUIDs use uuid-generator, for tokens use token-generator. Input: count option. Returns ULID strings. 100% client-side.