HMAC Generator
CryptoCompute HMAC signatures with SHA-1/256/384/512 algorithms for API authentication and request signing. Perfect for webhook signatures and API auth flows.
— — enter key + message — —— — enter key + message — —— — enter key + message — —— — enter key + message — —Related Tools
About HMAC Generator
HMAC feeds a message together with a secret key into a hash function to produce an authentication code that verifies both data integrity and origin. It powers webhook verification, API request signing, and the HS256 algorithm in JWTs. This tool uses the browser-native Web Crypto API to compute HMAC locally with your key, supporting SHA-1/SHA-256/SHA-384/SHA-512 and Hex or Base64 output. For example, signing the message hello with key secret produces a 64-char hex HMAC-SHA256 signature ready for API request verification.
How to Use
- Open the HMAC Generator tool
- Enter the content and set the parameters
- Adjust the output options as needed
- Click the Generate button; results appear in real time
- Copy or export the result
Use Cases
- Verify webhooks — Recompute HMAC-SHA256 with the platform secret and compare it to the signature header to confirm authenticity.
- Sign API requests — Build the string-to-sign per the vendor spec and generate an HMAC to send as an auth header.
- Debug JWT HS256 — Manually reproduce the HMAC over header.payload to diagnose signature verification failures.
- Cross-check implementations — Confirm an HMAC from a backend language like Java or Python matches the standard output.
- Sign idempotency keys — HMAC parameters such as order IDs to get a reproducible, tamper-evident check value.
- OAuth signature — Generate the HMAC digest for OAuth 1.0 parameter strings to authenticate API requests.
- Payload integrity — HMAC the request body with a shared key to produce a checksum for tamper detection.
FAQ
How is HMAC different from plain SHA-256?
Anyone can compute a plain hash, so it proves nothing about origin. HMAC mixes in a shared secret, and without that key you cannot produce the correct value, which authenticates that the message came from the key holder.
Should the key be text or Hex?
It depends on the server contract. Most webhooks use a UTF-8 text key, but some APIs require decoding the key from Hex/Base64 into raw bytes first. The two yield different results, so match your counterpart.
Which hash algorithm should I pick?
SHA-256 is the default recommendation, balancing security and speed. SHA-1 is only for legacy compatibility and is discouraged for new projects; use SHA-384/512 when you want a larger security margin.
What matters when comparing signatures?
Production code should use a constant-time compare to avoid leaking information through timing differences. This tool is for manual checks; verify the copied value securely in your code.
Is differing case or encoding a problem?
The raw HMAC is bytes; Hex case and Base64 are just representations. Normalize the encoding before comparing rather than treating a case difference as a mismatch.