HMAC Generator

The HMAC Generator allows you to create Hash-based Message Authentication Code (HMAC) signatures directly in your browser. Simply enter your message, provide a secret key, choose a supported hashing algorithm, and generate the HMAC instantly.

HMAC signatures are widely used to verify that data has not been altered and that it was created by someone who knows the shared secret key. They are commonly used in APIs, webhooks, authentication systems, and secure data exchange.

All calculations are performed locally in your browser using the Web Crypto API, helping keep your data private.

What Is an HMAC?

An HMAC (Hash-based Message Authentication Code) combines a secret key with a message and a cryptographic hash function to produce a unique signature.

Unlike a standard hash, an HMAC cannot be reproduced without the secret key. This allows two systems that share the same secret to verify that a message is authentic and has not been modified during transmission.

HMACs are designed for message authentication and integrity—not encryption.

How To Use the HMAC Generator

• Enter the message you want to sign.
• Enter your secret key.
• Select the hashing algorithm.
• Click Generate HMAC.
• Copy the generated signature for use in your application or testing.

Common Uses

HMAC signatures are commonly used for:

• Testing webhook signatures
• API authentication
• Verifying request integrity
• Secure message validation
• Software development
• Debugging authentication systems
• Learning cryptographic authentication
• Testing integrations between applications

Supported Algorithms

The HMAC Generator supports commonly used hashing algorithms, including:

• HMAC-SHA-256
• HMAC-SHA-384
• HMAC-SHA-512

The available options may vary depending on your browser's support for the Web Crypto API.

SHA-256 is the most commonly used option for modern web applications and APIs.

Understanding HMAC Signatures

When an HMAC is generated, three pieces of information are combined:

• The message
• The secret key
• The selected hashing algorithm

If any one of these changes—even by a single character—the generated signature will also change.

This makes HMACs an effective way to detect tampering and verify that a message came from a trusted source.

Webhook Verification

Many services use HMAC signatures to verify webhook requests.

A typical workflow is:

• A service sends a webhook along with an HMAC signature.
• Your application generates its own HMAC using the same secret key.
• The two signatures are compared.
• If they match, the request is considered authentic.

This process helps protect applications from receiving modified or unauthorised requests.

API Authentication

Some APIs require requests to be signed using HMAC.

This helps ensure that:

• The request hasn't been modified.
• The sender knows the shared secret key.
• The request can be verified by the receiving system.

HMAC authentication is commonly used for APIs that require an additional layer of security.

Tips for Better Results

• Keep your secret key private and never share it publicly.
• Use the same hashing algorithm on both the sending and receiving systems.
• Ensure the message being signed matches exactly, including spaces and line breaks.
• Store secret keys securely using your application's security best practices.
• Compare generated signatures carefully when troubleshooting authentication issues.

Frequently Asked Questions

What does the HMAC Generator do?

It generates HMAC signatures from a message and a secret key using supported cryptographic hashing algorithms.

What is the difference between an HMAC and a hash?

A standard hash only processes the input data. An HMAC combines the input data with a secret key, allowing the recipient to verify both the integrity and authenticity of the message.

Can I verify webhook signatures?

Yes. The HMAC Generator is useful for testing and comparing webhook signatures during development and troubleshooting.

Which algorithm should I use?

SHA-256 is commonly used by modern APIs and webhook providers, although some systems may require SHA-384 or SHA-512.

Is my secret key uploaded?

No. All HMAC calculations are performed locally within your browser using the Web Crypto API, and your message and secret key are not uploaded or stored.

Does this tool encrypt my message?

No. HMAC provides message authentication and integrity verification. It does not encrypt the message or keep its contents secret.

Is the HMAC Generator free?

Yes. You can generate HMAC signatures online for free without creating an account or downloading software.