Skip to content
Categories
HMAC Generator
Generate an HMAC from a message, secret, and algorithm.
Overview
- Generates an HMAC (Hash-based Message Authentication Code) from a Message and a Secret.
- HMAC is used to verify that a message has not been tampered with and that the sender actually knows the shared secret.
- Supports three hash algorithms: SHA-256, SHA-384, and SHA-512.
Usage
- Enter the Message (the string to hash) into the text area.
- Choose a Secret and an algorithm (SHA-256 / SHA-384 / SHA-512).
- Click the "Generate" button to display the HMAC value in hexadecimal. Use the "Copy" button to copy it to the clipboard.
Example
Input
Message: hello world Secret: my-secret Algorithm: SHA-256
Output
0aa5cf706962558525d3922c8b57ff2ec36ba9ee5f6ba7fdc6a5b6fda05df97
Use Cases
- Computing the expected HMAC value locally to check against it while implementing webhook or API request signature verification
- Confirming that a webhook signature received from an external service (such as a payment provider) is correctly computed from the shared secret
- Preparing test cases and test data for HMAC-based signature verification
FAQ
Is the Message or Secret I enter sent anywhere?
No. Everything is computed in your browser using the Web Crypto API and is never sent to an external server.
Can I generate an HMAC using SHA-1?
No. Only SHA-256, SHA-384, and SHA-512 are currently supported.
Can this also be used to verify a JWT signature?
You can generate the HMAC value itself, but for generating or validating JWTs we recommend using the JWT Generator and JWT Validator instead.
Notes
- Only HMAC-SHA256/384/512 are generated. HMAC-MD5 and HMAC-SHA1 are not supported.
- Do not enter a secret key that is actually used in production here.
- The generated result exists only on the page and is lost on reload, so copy and save it if you need to keep it.
Related Tools
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hash values from text.
Generate a JWT from a header, payload, and secret.
Validate a JWT's format, expiration, and signature.
Generate a bcrypt hash from a password or other text, and verify it against an existing hash.