HMAC Generator
Generate an HMAC signature from a message and secret key.
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a message with a secret key and a hash function to produce a signature that proves both the integrity of the message and knowledge of the secret key. Unlike a plain hash, an HMAC cannot be recomputed correctly by anyone who doesn't know the secret key, which is what makes it useful for authentication rather than just error-checking.
How to use it
- Enter the message you want to sign and the shared secret key.
- Choose the underlying hash algorithm — SHA-256 is the most common modern default.
- The HMAC signature updates automatically as you type.
HMAC is widely used to sign API requests (so a server can confirm a request genuinely came from a client that holds the shared secret), to verify webhook payloads from third-party services, and inside protocols like JWT when using an HMAC-based signing algorithm such as HS256. Both sides of a conversation need to hold the same secret key and use the same algorithm; if either the message, the key or the algorithm differs even slightly, the resulting HMAC will be completely different. This tool computes everything using your browser's native Web Crypto API, so your secret key is never transmitted anywhere.