HMAC Generator

An HMAC generator computes a Hash-based Message Authentication Code (HMAC) by combining a message with a secret key through a cryptographic hash function. Unlike a plain hash, the output changes completely if either the message or the key changes, so it proves both that the data is intact and that it came from someone who holds the key. This tool runs the full HMAC calculation in your browser, so you can generate and verify signatures for APIs, webhooks, and tokens without sending your secret anywhere.

Generating an HMAC signature takes a few seconds:

HMAC pads the secret key to match the hash function's block size, then combines it with the message using two passes of the underlying hash. The inner pass XORs the key with a fixed inner padding value and hashes it together with the message; the outer pass XORs the key with a different padding value and hashes it together with the result of the inner pass.

This nested construction is what protects HMAC against length-extension attacks that affect plain hashes like SHA-256 used alone. It is formally defined in RFC 2104 and used everywhere from TLS handshakes to signed API requests.

A plain hash such as MD5 or SHA-256 turns any input into a fixed-size fingerprint, but anyone can recompute that fingerprint, so it only proves the data was not corrupted. HMAC adds a secret key into the calculation, so only someone who knows the key can produce or check a matching value.

That extra step turns a hash into a message authentication code: proof of integrity and proof that the signer holds the shared secret. If you only need to detect corrupted files, use our Hash Generator; if you need to authenticate a message between two parties, HMAC is the right tool.

This generator computes HMAC with eight underlying hash functions, matching or exceeding what most competing HMAC tools offer:

As a rule of thumb, use HMAC-SHA256 unless a specific protocol or legacy system requires something else.

HMAC-SHA256: The Modern Standard

HMAC-SHA256 is the default choice for signing webhooks and API requests at companies like Stripe, GitHub, and Shopify, and it is also the algorithm behind the HS256 signature used in most JSON Web Tokens.

It offers a strong security margin, wide library support, and a 64-character hex output that is short enough to fit comfortably in HTTP headers.

SHA3-512: The Keccak-Based Alternative

SHA-3 uses a completely different internal design (Keccak) from the SHA-2 family, so an HMAC-SHA3 signature does not share any structural weaknesses that might one day be found in SHA-256 or SHA-512.

Choose it when a protocol specifically requires the SHA-3 family or when you want algorithm diversity alongside an existing SHA-2 signature.

MD5, SHA-1, and RIPEMD-160: Legacy Algorithms

HMAC-MD5 and HMAC-SHA1 are still considered cryptographically sound as message authentication codes, unlike plain MD5 or SHA-1 hashing, because the secret key mitigates the known collision attacks on the underlying hash.

Even so, most current guidance recommends moving to SHA-256 or better for new systems, and these variants are included here mainly to verify or interoperate with older APIs.

Compute Every Algorithm at Once

Switch the result mode to "All algorithms" to generate all eight HMAC variants for the same message and key in a single click, useful when you are testing which algorithm a legacy API expects.

Each result can be copied individually, or use "Copy all" to grab every signature at once.

Most APIs treat the secret key as plain UTF-8 text, but some issue keys as hexadecimal or Base64 strings, and signing with the wrong encoding is the most common reason a computed HMAC does not match what a server expects. This generator lets you tell it exactly how to interpret both the key and the message before hashing.

If your provider's documentation says the key is "base64-encoded", select Base64 for the key encoding rather than hashing the literal Base64 string as UTF-8 text -- the two produce completely different signatures.

Hexadecimal output is longer but easy to read and compare by eye, and it is the format most debugging tools and documentation examples use. Base64 output is roughly 25% shorter, which matters when a signature has to fit in an HTTP header such as Authorization or X-Signature.

Use whichever format the receiving system expects; this generator can produce lowercase hex, uppercase hex, or Base64 without recomputing anything.

Switch to the File tab to compute an HMAC over a file's raw bytes instead of typed text, useful for signing downloads, verifying software packages, or authenticating file uploads before they reach a server.

The file never leaves your device: it is read and hashed locally in your browser, then discarded.

Paste an HMAC value you received into the compare field and this tool checks it against the signature it just computed, so you can confirm a webhook payload or API response is authentic without writing any code.

In "All algorithms" mode, the comparison checks every variant at once, which is handy when you are not sure which hash function the sender used.

HMAC shows up anywhere two parties need to trust a message without exposing the secret that protects it:

A few habits keep HMAC signatures trustworthy:

Every calculation on this page, including HMAC generation, key parsing, and file hashing, runs locally in your browser using JavaScript. Your message, secret key, and any uploaded file are never transmitted to our servers or any third party.