HMAC Generator
Compute an HMAC (SHA-256, SHA-512, SHA-384 or SHA-1) of a message with a secret key.
Runs in your browser Your input never leaves your device.
Computed in your browser with the Web Crypto API. The key and message are not sent anywhere. SHA-1 is shown for old systems only. Text typed or pasted in the box has its line endings normalised to LF; if a service signed CRLF text, replace the line breaks in your source or compute the HMAC over the exact bytes with another tool.
Report a problem with this tool
About this tool
An HMAC is a keyed hash: it proves that a message came from someone who knows a shared secret key and was not changed on the way. Webhook signatures (for example from payment and Git services), signed API requests and many session tokens use HMAC-SHA256. Enter the message and the key, choose the hash function, and the tool shows the HMAC as hex and as base64, the two forms services use. The key can be typed as text (UTF-8) or given as hex or base64 when it is binary. The result is computed with the browser's Web Crypto API, so nothing leaves your device. The implementation was checked against the official RFC 4231 test vectors for SHA-256, SHA-384 and SHA-512, and against openssl on random keys and messages. SHA-1 is offered only for old systems. When you compare a signature from a service, make sure the message is byte for byte what the service signed: a trailing newline or different line endings change the result.
How to use it
- Type or paste the message exactly as it was signed.
- Enter the secret key and choose whether it is text, hex or base64.
- Pick the hash function the service uses, usually SHA-256.
- Copy the hex or base64 result and compare it with the signature you received.
Common problems
- My HMAC does not match the service
- Check the key format (text versus hex or base64), the hash function, and that the message is identical byte for byte, including whitespace and line endings.
- Is HMAC the same as a hash?
- No. A plain hash has no key, so anyone can compute it. An HMAC needs the secret key, which is what makes it an authenticity check.
- Can I paste a real secret key here?
- The key stays in your browser and is not sent anywhere, but treat production keys carefully and prefer test keys.