Skip to content
English
All tools

Categories

Developer ToolsEncoding & DecodingJSON & DataHash & ChecksumText ToolsDate & TimeNetwork ToolsFile ToolsMarkdown & Diagrams

HMAC Generator

Sign a message with a secret key using HMAC and copy the authentication code as hex or Base64.

Processed locally in your browser

Options

Use test keys only: never paste a production secret into any web page.

0 chars · 0 lines
The result will appear here.

What is HMAC Generator?

HMAC (RFC 2104) combines a hash function with a secret key to produce a message authentication code. Only someone who knows the key can compute or verify it, which is why HMAC-SHA256 signs webhooks, API requests, cookies and JWT tokens of the HS256 family.

Enter the message, then the key (as UTF-8 text, hex or Base64) and choose the hash. The tool implements the RFC 2104 construction on top of a WebAssembly hash and shows the code in hex or Base64, with key and message sizes. Only use test keys here.

How does it work?

  1. Paste the message in the input box.
  2. Type the secret key and select its encoding (UTF-8, hex or Base64), then pick the algorithm.
  3. Copy the HMAC as hex or Base64. Test: key "Jefe", message "what do ya want for nothing?" with SHA-256 gives 5bdcc146bf60754e…

Common use cases

  • Reproducing the signature of a webhook (Stripe-style, GitHub-style) to debug verification code.
  • Checking an HS256 JWT signature computation by hand.
  • Building signed query strings for APIs that use HMAC authentication.
  • Validating your language library against RFC 4231 test vectors.

Examples

Try this input in the tool above:

Input
The quick brown fox jumps over the lazy dog
Output
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Privacy

HMAC Generator runs entirely in your browser. The text or files you provide are processed on your device and are not uploaded, logged or stored on our servers.

Limitations

Never paste a production secret key into any web page, including this one. HMAC also proves integrity and origin only if the key stays secret; it does not encrypt the message.

Frequently asked questions

What is the difference between a hash and an HMAC?

A plain hash can be computed by anyone. An HMAC also needs a secret key, so only key holders can produce a valid code for a message.

Is HMAC-SHA1 or HMAC-MD5 still safe?

Because HMAC does not rely on collision resistance, HMAC-SHA1 is not broken by known attacks, but new designs should prefer HMAC-SHA256 or stronger.

Does the key length matter?

Keys longer than the hash block size are hashed first, and short keys are zero-padded. Use a random key at least as long as the digest (32 bytes for SHA-256).

Related tools

More tools in Hash & Checksum →