HMAC Generator & Verifier

Generate and verify HMAC-SHA256 and other HMAC signatures online

Use this free HMAC generator and HMAC verifier to create or check keyed hashes with SHA-256, SHA-512, SHA-384, or SHA-1. Ideal for API signatures, webhooks, and message authentication. 100% client-side via Web Crypto. Your secret never leaves your browser.

From the blog
Emergent Leader Pattern in Distributed Systems

How peer-to-peer clusters pick a coordinator by age, without ever running a leader election

Read

Developer tools Latest posts Explainers

HMAC Quick Reference

Algorithms

SHA-1160-bit, legacy
SHA-256256-bit, common default
SHA-384384-bit
SHA-512512-bit

Typical Uses

WebhooksSign request bodies
APIsRequest authentication
JWTHS256 / HS512
TokensSigned cookies, CSRF

HMAC Guide

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a cryptographic hash function to produce a digest that authenticates a message. Receivers with the same secret can recompute the digest and confirm the message was not changed and came from a trusted party.

Generate vs verify

Generate creates a new digest from your secret and message. Verify recomputes the digest and compares it to an expected value. Use the same algorithm and encodings on both sides or verification will fail even when the secret is correct.

Choosing an algorithm

  • HMAC-SHA256: Default for most APIs and webhooks.
  • HMAC-SHA512: Larger digest when policies require it.
  • HMAC-SHA1: Still seen in older systems; prefer SHA-256 for new work.
  • Key length: Prefer a random secret at least as long as the hash output when possible.

Using this HMAC tool

All signing runs in your browser with the Web Crypto API. Secrets and messages are not uploaded. For encoding payloads or inspecting tokens, see the Base64 Encoder and JWT Decoder.

HMAC Generator FAQ

What is HMAC?

HMAC is a keyed hash that authenticates a message using a shared secret and a hash such as SHA-256. It proves integrity and that the sender knew the secret.

How do I generate an HMAC online?

Open Generate, enter your secret and message, choose an algorithm such as HMAC-SHA256, and copy the hex or Base64 digest. Computation stays in your browser.

How do I verify an HMAC signature?

Switch to Verify, enter the same secret, message, and algorithm, paste the expected HMAC, and click Verify. The tool reports whether the digests match.

Which HMAC algorithms does this tool support?

HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 via the Web Crypto API. HMAC-SHA256 is the usual default for APIs and webhooks.

Is my secret key safe when using this HMAC generator?

Computation is local and not uploaded. Still avoid pasting production secrets on shared or untrusted devices.

What is the difference between HMAC and a plain hash?

A plain hash has no secret. Anyone can recompute it. HMAC requires a secret, so only key holders can forge a valid signature.

Should I use hex or Base64 for HMAC output?

Both represent the same bytes. Hex is easy to read; Base64 is shorter and common in headers. Match what your API expects.

Is HMAC encryption?

No. HMAC authenticates; it does not encrypt. Use TLS or encryption when you need confidentiality. Related tools: Base64 Encoder, JWT Decoder.