HMAC Generator
Compute HMAC-SHA-256, SHA-384, and SHA-512 in the browser.
About this tool
Generate HMAC message authentication codes with a secret key — for webhook signatures (Stripe, GitHub, Slack), API auth debugging, and JWT HS* sanity checks. All crypto runs locally.
What you get
- HMAC-SHA-256, SHA-384, and SHA-512 hex digests
- Live update on message or key change
- One-click copy per algorithm
How to use
Enter the message and secret key, then copy the HMAC your service expects. Keys are not sent anywhere.
FAQ
How to generate HMAC-SHA256 online?
Enter the message and secret key, then copy the SHA-256 HMAC hex digest. SHA-384 and SHA-512 are shown in the same view.
What is HMAC used for?
HMAC proves a message was signed with a shared secret—common for webhook signatures, API auth, and HS* JWT sanity checks.
Which HMAC algorithm should I use?
Prefer HMAC-SHA256 for new integrations. SHA-384 and SHA-512 offer longer digests when a service explicitly requires them.
How to verify webhook signatures with HMAC?
Compute HMAC over the raw request body with your endpoint secret and compare the hex digest to the provider's signature header.
By using this tool you agree to our Terms of Use and Privacy Policy. Results are provided as-is without warranty.