HMAC Generator
Generate HMAC signatures with SHA-256, SHA-384, SHA-512, or MD5. Used for API auth and webhook verification. 100% client-side.
🔒 100% private: All computation happens in your browser. Your secret key never leaves your device. For production secrets, prefer running HMAC locally with Node.js or the OpenSSL CLI.
43 chars
HMAC-SHA256 (hex)
92f182c8827f020578c05e2c053eb428127cadf2fad538b2704f67b3d32c941e
🔒 100% private: All computation is local. Follows RFC 2104 (HMAC) and FIPS 180-4 (SHA-2). MD5 provided for legacy compatibility only.
About HMAC Generator
HMAC (Hash-based Message Authentication Code) is a cryptographic technique that combines a secret key with a message to produce a signature. Unlike plain hashes (SHA-256 of a message), HMAC requires the secret key — so anyone without the key cannot forge or verify the signature. HMAC is used everywhere: signing API requests (AWS Signature v4, Stripe webhooks, Shopify, GitHub webhooks), verifying JWTs (HS256), authenticating OAuth 1.0 requests, and protecting session tokens. This tool computes HMAC signatures using the browser's native crypto (or a pure-JS fallback for HTTP), supporting SHA-256, SHA-384, SHA-512, and MD5. The secret key and message are processed entirely locally — nothing is transmitted.
How It Works
- Choose the hash algorithm: SHA-256, SHA-384, SHA-512, or MD5.
- Enter your secret key (the shared key used by both parties).
- Enter the message (the data to sign).
- Choose the output format: hex or base64.
- Copy the signature. Optionally verify against an expected value.
✨ Key Features
- ✓HMAC-SHA256 (most common for APIs and JWTs)
- ✓HMAC-SHA384 and HMAC-SHA512
- ✓HMAC-MD5 (legacy compatibility)
- ✓Hex and base64 output formats
- ✓Secret key and message in plain text or hex
- ✓Verification mode (compare against expected HMAC)
- ✓Timing-safe comparison option
- ✓Copy to clipboard
- ✓Works offline — no network calls
- ✓100% client-side — your secrets never leave your device
🎯 Common Use Cases
- →Generating signatures for AWS Signature v4
- →Verifying Stripe, Shopify, or GitHub webhook signatures
- →Debugging JWT HS256 signature computation
- →Signing OAuth 1.0 API requests
- →Testing HMAC-based authentication in your own API
- →Learning how HMAC works step-by-step
- →Verifying HMAC signatures in server logs
- →Cross-checking signature libraries (Node.js, Python, PHP)
💡 Advanced Tips & Pro Insights
- ▸HMAC = H((K ⊕ opad) || H((K ⊕ ipad) || message)), where K is the key (padded/hashed to block size), opad = 0x5c repeated, ipad = 0x36 repeated. This double-hashing is what makes HMAC resistant to length-extension attacks.
- ▸SHA-256 is the standard for new APIs. SHA-1 and MD5 are legacy — use only for compatibility. SHA-384/512 for higher security margins.
- ▸Never reuse the same HMAC key across services. Generate a unique key per service, per environment.
- ▸Always use timing-safe comparison when verifying HMACs. Naive string comparison leaks timing info that attackers can exploit.
- ▸For JWTs with HS256, the "key" is the shared secret and the "message" is base64url(header) + "." + base64url(payload) — the signature covers both.
- ▸For Stripe webhooks: signature = HMAC-SHA256(timestamp + "." + payload, webhook_secret). Always verify the timestamp to prevent replay attacks.
Frequently Asked Questions
Is this HMAC generator free?▾
Yes, this HMAC generator is completely free with no signup, email, or usage limits.
Is my data safe?▾
Yes, 100% safe. All computation happens in your browser. Your secret key and message are never transmitted. However, as best practice, avoid pasting production secrets into any online tool unless you control the environment.
What is HMAC?▾
HMAC (Hash-based Message Authentication Code) is a cryptographic signature that combines a secret key with a message. Unlike a plain hash, it requires the secret key — so only parties with the key can generate or verify the signature.
Which algorithm should I use?▾
For new applications, use HMAC-SHA256. It is widely supported, secure, and fast. Use SHA-384 or SHA-512 for higher security margins. MD5 and SHA-1 are legacy and should only be used for compatibility with older systems.
What is the difference between a hash and HMAC?▾
A plain hash (SHA-256) does not use a key — anyone can compute it. HMAC uses a secret key, so only parties with the key can generate or verify it. Use HMAC for authentication, plain hashes for integrity or fingerprinting.
How do I verify a webhook signature?▾
For most webhooks (Stripe, Shopify, GitHub), the provider sends an HMAC-SHA256 signature in a header. Compute HMAC-SHA256(payload, secret) and compare with the received signature using timing-safe comparison. Different providers may include a timestamp prefix — check the docs.
Why is timing-safe comparison important?▾
Naive string comparison (===) short-circuits on the first mismatched byte, so the time taken depends on how many bytes match. An attacker can measure this to guess the correct HMAC byte-by-byte. Timing-safe comparison takes constant time regardless of where the difference is.
Can I use this for JWT signing?▾
Yes — for HS256/384/512 JWTs, HMAC is the signature algorithm. The "message" is base64url(header) + "." + base64url(payload), and the key is the JWT secret. The output signature should be base64url-encoded (not standard base64). This tool outputs base64 or hex; for JWTs, use base64url (replace + → -, / → _, strip padding).