HMAC Generator

Compute an HMAC (keyed-hash message authentication code) of a message using SHA-1, SHA-256, SHA-384, or SHA-512, right in your browser using the Web Crypto API.

Message

Secret Key

Algorithm

How was this tool?

Your feedback helps us improve HMAC Generator.

Why use HMAC Generator?

HMAC combines a cryptographic hash function with a secret key to produce a keyed hash used for verifying both the integrity and authenticity of a message. It is the mechanism behind most webhook signature schemes (Stripe, GitHub, and similar providers all verify HMAC-SHA256 signatures), and it is also used for signing API requests and session tokens. This tool runs the computation using the browser's native Web Crypto API: type a message, enter a secret key, pick SHA-1, SHA-256, SHA-384, or SHA-512, and the hex-encoded HMAC appears instantly. Nothing is sent to a server, so it is safe to test with real secrets during development. The Generate HMAC button stays disabled until a secret key is entered, which prevents an accidental empty-key computation. Results are shown as lowercase hex and can be copied with one click, which is convenient when you need to paste a value into a request header, a config file, or a test script while debugging a signature mismatch.

Key benefits

Uses the browser's native Web Crypto API for accurate results
Four hash algorithm options
Your message and key never leave your browser
No account or installation required
Recomputes instantly when you change the algorithm, message, or key

Features

HMAC computation via Web Crypto API
Hex-encoded output
One-click copy
HMAC-SHA1 option for legacy system compatibility
Generate button stays disabled until a secret key is entered

Popular use cases

Verifying a webhook signature during development
Generating a test HMAC for an API integration
Learning how HMAC authentication works
Confirming an HMAC value produced by a backend service or script

How to use HMAC Generator

1
Enter your message
Type or paste the message you want to authenticate.
2
Enter a secret key
Enter the shared secret key used to compute the HMAC.
3
Choose an algorithm and generate
Select SHA-1, SHA-256, SHA-384, or SHA-512, then click Generate HMAC.
4
Copy the result
Click Copy to copy the hex-encoded HMAC to your clipboard.

Frequently asked questions

Is this the same HMAC used by webhook providers like Stripe or GitHub?

Yes, HMAC-SHA256 in particular is the standard used by most webhook signature schemes, computed the same way this tool does.

Is my secret key sent to a server?

No. The Web Crypto API computes the HMAC entirely within your browser. Nothing is transmitted.

Which algorithm should I use?

HMAC-SHA256 is the most common modern default; use whichever algorithm matches what the system you're integrating with expects.

Why is the Generate HMAC button disabled?

It stays disabled until you enter a secret key, since HMAC requires both a message and a key to compute.

What is HMAC-SHA1 still used for?

It's included for compatibility with older systems and legacy integrations that have not moved to SHA-256 or higher, though SHA-256 is preferred for new work.

Last reviewed: July 2026

How was this tool?

Related tools