HMAC Generator

Generate secure HMAC hashes (SHA256, SHA512) with a secret key.

Secret Key

Algorithm

Sign a message with a shared secret

An HMAC is a keyed hash: it combines a message and a secret key so that only someone who knows the key can produce the matching value. Webhooks, API request signing and cookie protection all use this idea. Anyone implementing or debugging such a scheme needs to compute the expected signature by hand, and this generator does that from a message, a key and a choice of hash function.

Generating an HMAC

Enter the text to sign in the Input Data area. The Sample button loads a short example message, and Clear empties the box.
Type your key into Secret Key. The field starts with a placeholder secret, which you should replace.
Choose an Algorithm from the drop-down: SHA-256 (default), SHA-384, SHA-512 or SHA-1.
Click Process Now.
The result appears as a hexadecimal string, with a line naming the algorithm used, such as HMAC-SHA-256. Use Copy or Download to keep it.

If either the message or key is empty you will see an error asking for it.

How it is calculated

The tool uses the browser's Web Crypto interface. Your key and message are converted to UTF-8 bytes, the key is imported as an HMAC key for the chosen hash, and the message is signed. The signature bytes are shown as lowercase hex, so the output length is 64 characters for SHA-256, 96 for SHA-384, 128 for SHA-512 and 40 for SHA-1.

Typical situations

Checking a webhook signature by recomputing it from the raw request body and the shared secret.
Producing sample signatures for API documentation or unit tests.
Verifying that your own code's HMAC output matches a known-good reference.
Learning how changing one character of the key or message completely changes the signature.

Details that trip people up

The output is hex only; some services expect Base64, so you would need to convert it. The message must match byte for byte, including whitespace and line endings, which is why signatures for webhook bodies often fail when JSON is reformatted. Keys are treated as plain text, so a key that is hex or Base64 encoded in your system will not be decoded here. Prefer SHA-256 or stronger; SHA-1 is offered mostly for older integrations.

An HMAC proves integrity and that the sender knew the key; it does not encrypt the message. Avoid pasting real production secrets into any web page if you do not need to, and use a test key when possible. Web Crypto usually works only on secure (HTTPS) pages.

Related Articles

Public and Private Keys Explained Simpl

Related Tools

Frequently Asked Questions

Which hash algorithms are available?

The Algorithm drop-down offers SHA-256, SHA-384, SHA-512 and SHA-1. SHA-256 is selected by default and is the usual choice for new work, while SHA-1 is included only for compatibility with older systems and integrations.

What format is the output in?

The signature is shown as a lowercase hexadecimal string. If your API expects Base64, you will need to convert the hex value separately, because this tool does not offer Base64 output.

Why does my HMAC not match the one from a service?

Usually the message differs by a byte, such as reformatted JSON, added whitespace or different line endings. The key may also be encoded differently: this tool treats the key as plain text and does not decode hex or Base64 keys.

Is an HMAC the same as encryption?

No. An HMAC verifies integrity and that the sender knew the shared key, but the message itself remains readable. It also cannot be reversed to recover the message or key.

Do I need both a message and a key?

Yes. If either field is empty, the tool shows an error asking for it instead of producing a result. The key can be any text you choose, and longer keys are generally better.