HMAC Generator

Compute HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512. Text, hex, or Base64 keys with hex and Base64 output — all in your browser.

All calculations run locally in your browser. Your message and key never leave your device.

What is an HMAC generator?

An HMAC generator computes a Hash-based Message Authentication Code: a signature that binds your message to a secret key. Receivers who share the key can verify the message is authentic and untampered.

HMAC is everywhere — API request signing, webhook verification, JWT validation. This tool computes HMAC with SHA-1, SHA-256, SHA-384 or SHA-512 using the browser's native Web Crypto API, so your message and key never leave your device.

How to generate an HMAC signature

Enter the message and the secret key, pick the key format and hash algorithm, then press Generate.

The signature is shown as both hex and Base64 — use whichever your API or service expects, and copy it with one click.

Choosing the key format

Text keys are encoded as UTF-8 bytes. Hex and Base64 keys are decoded to raw bytes first, so a key stored in another encoding still produces the correct signature.

Choosing the hash algorithm

SHA-256 is the common default today. SHA-384 and SHA-512 offer a higher security margin, while SHA-1 remains only for legacy systems that still require it.

Common use cases

Use this tool to verify API signatures, debug webhook payloads, or cross-check an HMAC implementation against a known message and key.

Frequently Asked Questions

What is an HMAC signature?+
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to prove that a message is authentic and untampered. It is widely used for API request signing and webhook verification.
Which hash algorithms are supported?+
SHA-1, SHA-256, SHA-384 and SHA-512, all computed with the browser's native Web Crypto API.
What key formats can I use?+
Text, hexadecimal, or Base64. When integrating with a server, make sure the key encoding matches what the other side expects.
Is my data safe?+
Yes. Everything runs locally in your browser — the message and the key are never sent to or stored on any server.
Why doesn't my HMAC match the server's?+
The most common causes are a key-format mismatch (text vs hex vs Base64) or using a different hash algorithm than the other side. Check both.

Related Tools

Hash GeneratorJWT DecoderBase64 Encoder

HMAC Generator — free online hmac generator, hmac signature, hmac sha256, hmac sha512 online, hmac hash generator, generate hmac signature, hmac base64, hmac hex output, hmac sha-1 online, api signature generator. No signup required. Works in your browser.