974dd242a6c0e525c85a002a7fff23c92d939cfacbb4a4ba5013496bdb96dcf689732289ca61efc2624d450f1e747c6ef1b59b3188cd859abe72bdb850dd47b96b2ba387f2ff321f19a63772fd3778e5fa01e294ee81889a0a7795813170219a8d84cad09ba350853656aef8adac4d2ea4435ac11fb2ac03ff58e8e5d4863c1fa02d11d602c1336dcf059e11d98a154775e91b45b42b19fad54599ca43a6eb0a8e7b5a2fAbout HMAC Generator
HMAC feeds a message together with a secret key into a hash function to produce an authentication code that verifies both data integrity and origin. It powers webhook verification, API request signing, and the HS256 algorithm in JWTs. This tool uses the browser-native Web Crypto API to compute HMAC locally with your key, supporting SHA-1/SHA-256/SHA-384/SHA-512 and Hex or Base64 output. Both the key and message stay in your device memory and are never sent to a server, so you can copy the result and compare it byte-for-byte with your server signature. Tip: Bookmark this tool for quick access whenever you need to generate keys or hashes. All processing happens locally in your browser — no data upload, so it is safe to use with sensitive material.
How to Use
- Open the HMAC Generator tool page
- Enter or paste your data into the input area
- View the real-time results and use the copy button to get the output
Use Cases
- Verify webhooks — Recompute HMAC-SHA256 with the platform secret and compare it to the signature header to confirm authenticity.
- Sign API requests — Build the string-to-sign per the vendor spec and generate an HMAC to send as an auth header.
- Debug JWT HS256 — Manually reproduce the HMAC over header.payload to diagnose signature verification failures.
- Cross-check implementations — Confirm an HMAC from a backend language like Java or Python matches the standard output.
- Sign idempotency keys — HMAC parameters such as order IDs to get a reproducible, tamper-evident check value.
- OAuth signature — Generate the HMAC digest for OAuth 1.0 parameter strings to authenticate API requests.
- Payload integrity — HMAC the request body with a shared key to produce a checksum for tamper detection.
FAQ
How is HMAC different from plain SHA-256?
Anyone can compute a plain hash, so it proves nothing about origin. HMAC mixes in a shared secret, and without that key you cannot produce the correct value, which authenticates that the message came from the key holder.
Should the key be text or Hex?
It depends on the server contract. Most webhooks use a UTF-8 text key, but some APIs require decoding the key from Hex/Base64 into raw bytes first. The two yield different results, so match your counterpart.
Which hash algorithm should I pick?
SHA-256 is the default recommendation, balancing security and speed. SHA-1 is only for legacy compatibility and is discouraged for new projects; use SHA-384/512 when you want a larger security margin.
What matters when comparing signatures?
Production code should use a constant-time compare to avoid leaking information through timing differences. This tool is for manual checks; verify the copied value securely in your code.
Is differing case or encoding a problem?
The raw HMAC is bytes; Hex case and Base64 are just representations. Normalize the encoding before comparing rather than treating a case difference as a mismatch.
Any browser compatibility requirements?
This tool works in all modern browsers (Chrome, Firefox, Edge, Safari). No plugins or extensions required.
Can I use it offline?
After initial load, most features work offline. The core logic runs entirely in your browser with no network dependency.
Comments
💬 Comments are stored locally in your browser. Configure Giscus for cloud-based comments.