HMAC Generator
Compute the HMAC (authenticated hash) of a message with your secret key. Supports SHA-256, SHA-512, SHA-1 and MD5. All local, nothing sent.
Input
HMAC with SHA-256 is the current standard (HS256, JWT, API keys). MD5 is included for legacy compatibility.
HMAC signature
Type the message to sign it.
How to use: HMAC
- 1Type the message you want to sign.
- 2Enter the secret key and pick the algorithm (e.g. SHA-256).
- 3Copy the generated HMAC signature.
What is it for?
- Verify webhook signatures (Stripe, GitHub, Shopify…).
- Debug authentication for APIs that sign requests.
- Check HS256 token signatures.
HMAC: authenticating messages with a key
What it adds
HMAC combines a hash function with a secret key to produce a signature. Anyone without the key cannot generate a valid signature, and any change to the message invalidates it.
Common uses
Verifying webhooks (Stripe, GitHub), signing API parameters or protecting cookies. The receiver recomputes the HMAC with the same key and compares.
Best practices
Use SHA-256 or stronger, long random keys, and compare signatures in constant time to avoid timing attacks. Do not use an HMAC key for encryption.
Related tools
Frequently asked questions
What is HMAC?+
It's a keyed hash that verifies both the integrity and authenticity of a message. Used in API signatures and webhooks.