SEOlust logo SEOlust
Developer & Utilities

HMAC Generator

Generate an HMAC (SHA-256, SHA-1, SHA-384, SHA-512) from a message and secret key, in hex or Base64 — for API signing and webhook verification. Runs in your browser. Free.

All tools
—
HMAC-SHA256

🔒 Private by design

  • The HMAC is computed locally in your browser with the Web Crypto API — your message and key never leave your device.
  • HMAC verifies both the integrity and the authenticity of a message using a shared secret key.
  • Common in API request signing, webhooks (e.g. verifying payloads), and secure tokens.

Free HMAC Generator (SHA-256, SHA-1, SHA-512)

Generate an HMAC for any message and secret key, right in your browser. Supports HMAC-SHA256, SHA-1, SHA-384, and SHA-512, with hex or Base64 output. Your message and key are processed locally with the Web Crypto API and never leave your device. Free, no sign-up.

What is an HMAC?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature that proves two things at once: that a message has not been altered (integrity) and that it came from someone who knows the key (authenticity). Unlike a plain hash, an HMAC cannot be recreated by an attacker who does not have the secret, which is why it is the standard way to sign API requests and verify webhooks.

HMAC vs a plain hash

The difference is the secret key:

  • A plain hash (like SHA-256) can be computed by anyone from the message alone.
  • An HMAC also requires the secret key, so only parties who share the key can produce or verify it.
  • This makes HMAC suitable for authentication, while a plain hash only proves integrity.
  • HMAC is resistant to length-extension attacks that affect naive keyed hashes.

How to generate an HMAC

It is instant:

  • Enter the message you want to authenticate.
  • Enter the shared secret key.
  • Choose the hash algorithm (SHA-256 is the most common) and output format.
  • Copy the resulting HMAC signature.

Where HMAC is used

HMAC appears throughout modern web development. Payment providers and APIs sign requests with HMAC so servers can confirm a request is genuine and untampered. Webhook senders (Stripe, GitHub, Shopify and many others) include an HMAC signature header so you can verify a payload really came from them. HMAC also underpins JWT tokens signed with HS256, and is used in one-time-password schemes.

How to verify a webhook signature

To verify an incoming webhook, take the raw request body, compute an HMAC over it using the shared secret and the algorithm the sender specifies, then compare your result to the signature they sent. If they match, the payload is authentic and unmodified. Always compare using a constant-time comparison on your server to avoid timing attacks, and use the exact raw body bytes the sender signed.

Pro tip

Use a long, random secret key and keep it private on your server — anyone with the key can forge valid HMACs. Match the algorithm and output encoding (hex or Base64) to exactly what the other side expects, since a mismatch will make valid signatures appear invalid. For plain hashing without a key, see our SHA-256 Hash Generator; for signing tokens, see our JWT Generator.

FAQ

Is this HMAC generator free and private?
Yes. It is free and computes the HMAC entirely in your browser with the Web Crypto API, so your message and secret key are never uploaded.
What is the difference between HMAC and a hash like SHA-256?
A plain hash needs only the message and can be computed by anyone. An HMAC also requires a secret key, so it proves both that the message is unchanged and that it came from someone who knows the key.
Which HMAC algorithm should I use?
HMAC-SHA256 is the most widely used and a safe default. Use SHA-384 or SHA-512 for longer signatures, and only use SHA-1 for compatibility with older systems.
How do I verify a webhook with HMAC?
Compute an HMAC over the raw request body using the shared secret and the sender's algorithm, then compare it to the signature they sent. If they match, the payload is authentic. Use a constant-time comparison on the server.
Can an HMAC be reversed?
No. Like a hash, an HMAC is one-way — you cannot recover the message or key from it. You verify by recomputing the HMAC and comparing.
Should the output be hex or Base64?
Use whichever format the system you are integrating with expects. Both represent the same bytes; a mismatch in encoding will make a valid signature look invalid. This tool supports both.
Is HMAC used in JWT?
Yes. JWTs signed with HS256, HS384, or HS512 use HMAC with the corresponding SHA algorithm and a shared secret. Our JWT Generator creates such tokens.

Related tools

Pro tip: pair this tool with Upside Down Text Generator and Text Similarity Checker for a faster SEO workflow.