HMAC Generator

What is HMAC Generator?

HMAC Generator computes Hash-based Message Authentication Codes using the Web Crypto API with support for SHA-256, SHA-384, and SHA-512 digest algorithms. HMAC combines a secret key with the message to produce a fixed-length authentication tag that verifies both data integrity and authenticity. The tool outputs results in hexadecimal and Base64 formats.

API developers implementing webhook verification, security engineers building authentication systems, and integration engineers working with signed request protocols. The tool runs entirely in your browser — your data never leaves your device.

How to Use HMAC Generator

1. Enter or paste the message you want to authenticate
2. Input your secret key in the key field
3. Select the hash algorithm — SHA-256, SHA-384, or SHA-512
4. View the HMAC output in both hexadecimal and Base64 formats
5. Copy the HMAC value to use in your authentication header or verification logic

Common Use Cases

• Generating webhook signature headers for Stripe, GitHub, or Shopify event verification
• Computing API request signatures for AWS Signature V4 or other HMAC-based auth schemes
• Verifying the authenticity of incoming webhook payloads by computing and comparing HMAC digests
• Creating signed URLs with expiration for secure temporary file access
• Implementing message authentication for inter-service communication in microservice architectures

Pro Tips

• Use a constant-time comparison function when verifying HMAC signatures in code — using simple string equality (==) is vulnerable to timing attacks that can leak the correct signature byte by byte
• The secret key should be at least as long as the hash output (32 bytes for SHA-256) — shorter keys are padded but provide less security
• HMAC-SHA256 is the most widely used variant for webhook signatures — Stripe uses it for its Webhook-Signature header, and GitHub uses it for X-Hub-Signature-256

Why Use This Tool?

• Privacy-first: All processing happens locally in your browser. No data is transmitted to any server.
• No installation required: Works in any modern browser on desktop or mobile.
• Completely free: No account, no credit card, no usage caps.
• Fast and reliable: Powered by modern Web APIs for near-instant results.

Related Concepts

Learn more about related topics: RFC 2104, Message authentication, Webhook signature, AWS SigV4.

Frequently Asked Questions