HMAC Generator

Compute an HMAC (keyed-hash message authentication code) of a message using SHA-1, SHA-256, SHA-384, or SHA-512, right in your browser using the Web Crypto API.

Message

Secret Key

Algorithm

How was this tool?

Your feedback helps us improve HMAC Generator.

Why use HMAC Generator?

HMAC combines a cryptographic hash function with a secret key to produce a keyed hash used for verifying both the integrity and authenticity of a message — commonly used for webhook signatures and API request signing. This tool computes it using the browser's native Web Crypto API, so your message and secret key never leave your device.

Key benefits

Uses the browser's native Web Crypto API for accurate results
Four hash algorithm options
Your message and key never leave your browser

Features

HMAC computation via Web Crypto API
Hex-encoded output
One-click copy

Popular use cases

Verifying a webhook signature during development
Generating a test HMAC for an API integration
Learning how HMAC authentication works

How to use HMAC Generator

1
Enter your message
Type or paste the message you want to authenticate.
2
Enter a secret key
Enter the shared secret key used to compute the HMAC.
3
Choose an algorithm and generate
Select SHA-1, SHA-256, SHA-384, or SHA-512, then click Generate HMAC.

Frequently asked questions

Is this the same HMAC used by webhook providers like Stripe or GitHub?

Yes — HMAC-SHA256 in particular is the standard used by most webhook signature schemes, computed the same way this tool does.

Is my secret key sent to a server?

No. The Web Crypto API computes the HMAC entirely within your browser — nothing is transmitted.

Which algorithm should I use?

HMAC-SHA256 is the most common modern default; use whichever algorithm matches what the system you're integrating with expects.

Last reviewed: July 2026

How was this tool?

Related tools