HMAC Generator
Compute keyed-hash message authentication codes (HMAC) with SHA-256, SHA-384, SHA-512 or SHA-1. Ideal for testing API signatures and webhooks. Your key is hashed locally in the browser — never uploaded.
Message
Signature
What you can do next
FAQ
Is my secret key sent anywhere?
No. The HMAC is computed by the Web Crypto API inside your browser. Neither the key nor the message ever leaves your device.
What is HMAC used for?
Signing API requests and verifying webhooks — Stripe, GitHub, Slack and most payment or messaging platforms authenticate payloads with HMAC-SHA256. Paste the payload and your signing secret here to reproduce or debug a signature.
How is HMAC different from a plain hash?
A plain SHA-256 proves integrity only. HMAC mixes in a secret key, so it also proves the message came from someone who holds that key — that's authentication, not just a checksum.
Hex or Base64 — which output should I use?
It depends on the platform. Stripe uses hex, JWT signatures use Base64URL, many webhook providers use standard Base64. Copy whichever your API docs expect.