HMAC Generator

Generate or verify HMAC signatures using SHA-256, SHA-384, SHA-512, or SHA-1. 100% client-side - your secret key never leaves your browser.

Last reviewed: April 2026
Reviewed by , software engineer · last updated April 2026

New to this tool? Click here for instructions

Message
Secret Key
HMAC Output
Both Formats
Enter a message and secret key to generate an HMAC signature.

How to Use the HMAC Generator

The HMAC Generator is a free online tool that allows you to generate and verify HMAC signatures using various hashing algorithms such as SHA-256, SHA-384, SHA-512, and SHA-1. Here's a step-by-step guide on how to use it:

1. Select an Algorithm: Choose the HMAC algorithm you want to use from the options provided (SHA-256, SHA-384, SHA-512, or SHA-1). SHA-256 is recommended due to its industry-standard status.

What Is HMAC and Why Is It Used?

HMAC stands for Hash-based Message Authentication Code. It is a cryptographic primitive used to verify the integrity and authenticity of a message. Unlike a plain hash, HMAC requires a shared secret key, making it much more secure against forgery. HMAC is widely used in various real-world systems, including AWS Signature Version 4, GitHub webhooks, and Stripe webhook events.

Frequently Asked Questions

HMAC (Hash-based Message Authentication Code) is a cryptographic algorithm that combines a secret key with a hash function (like SHA-256) to produce a message authentication code. It verifies both the integrity and authenticity of a message - ensuring it has not been tampered with and was created by someone holding the shared secret key.
A plain SHA-256 hash is a one-way fingerprint of data - anyone can compute it. HMAC-SHA256 mixes in a secret key, making the resulting signature impossible to reproduce without that key. This makes HMAC suitable for authentication and API request signing, whereas a plain hash only verifies integrity.
Yes. This tool runs 100% in your browser using the Web Crypto API. Your secret key, message, and generated HMAC are never sent to any server. No data ever leaves your device. You can safely use real API keys and secrets here.
For new applications, use HMAC-SHA256 - it is the current industry standard used by AWS, GitHub webhooks, Stripe, and most modern APIs. HMAC-SHA512 provides a longer digest for higher-security scenarios. HMAC-SHA1 is still used by legacy systems but should be avoided for new work.
Switch to Verify mode using the chip at the top. Enter the original message, the secret key, and paste the HMAC you want to verify. The tool recomputes the HMAC and compares it. A green status bar means the signature is valid; red means it does not match - indicating tampering or a wrong key.

Quick reference

HMAC Generator Quick Reference
Parameter Description Common Value Notes
Hash Algorithm Underlying cryptographic hash function SHA-256 Also supports SHA-1, SHA-512
Key Length Secret key size in bits or bytes 128 bits Must match key derivation requirements
Data Input Message to be hashed "example_data" Encoded as UTF-8 or binary
Output Format Encoded representation of HMAC Hexadecimal Also available in Base64
Key Derivation Method for generating keys PBKDF2 Requires salt and iteration count
Block Size Internal hash function block size 512 bits Varies by hash algorithm