HMAC Generator
Generate and verify Keyed-Hash Message Authentication Codes (HMAC) in real-time. Compute SHA-256, SHA-512, and legacy digests with configurable key encodings and zero server transmission.
HMAC-SHA256 Authenticator
hash(key ⊕ opad || hash(key ⊕ ipad || message))
Client-Side Cryptographic Message Authentication
The HMAC Generator computes and verifies Keyed-Hash Message Authentication Codes (HMAC) entirely inside your browser using the native Web Crypto API. By combining a cryptographic hash function with a secret key, HMAC guarantees both the integrity and the authenticity of a message.
Web developers, system engineers, and security professionals rely on HMAC to verify webhook deliveries from platforms like GitHub, Stripe, and Shopify, authenticate API requests via AWS Signature V4, and sign JSON Web Tokens (JWT). If either the message content or the shared secret key differs by a single bit, the resulting authentication digest will fail verification.
This utility supports industry-standard SHA-2 (SHA-256, SHA-512, SHA-384, SHA-224) and legacy algorithms (SHA-1, MD5), accommodating UTF-8, hexadecimal, and Base64-encoded secret keys with customizable hexadecimal and Base64URL output representations.
Core Tool Capabilities
- Hardware-Accelerated Web Crypto API: Computes signatures in browser memory using native SubtleCrypto for maximum throughput and sub-millisecond latency.
- Flexible Key Encoding: Accepts secret keys in UTF-8 plain text, raw hexadecimal strings, or Base64 formats.
- Multi-Format Output Encodings: Export digests as lowercase hex, uppercase hex, standard Base64, or URL-safe Base64URL strings.
- Instant Signature Verification: Compare incoming request signatures with computed digests using normalized constant-time verification.
- Production Webhook Presets: Pre-load common payload templates for GitHub Webhooks, Stripe Signatures, and AWS Signature V4.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Webhook Verification
- • REST API Authentication
- • Session & Token Integrity
Technical Specifications & Platform Limits
Standard RFC 2104 cryptographic hash suites.
Direct binary decoding for raw cryptographic key bytes.
Standard formats required by major cloud and payment APIs.
Offline-capable client execution.
Native hardware acceleration with pure JS fallback.
Step-by-Step Workflow
Enter Secret Key
Type or paste your private secret key and select its input encoding (UTF-8, Hex, or Base64).
Provide Message Payload
Enter or paste the raw message, JSON body, or webhook payload to authenticate.
Select Hash Algorithm
Choose HMAC-SHA-256 (recommended), HMAC-SHA-512, or an alternative digest based on your API requirements.
Copy or Verify Digest
Copy the resulting authentication code or switch to 'Verify Signature' to compare against an incoming header.
Practical Real-World Use Cases
Webhook Verification
Verifying signatures on incoming webhooks from Stripe, GitHub, Slack, and Shopify before processing payloads.
REST API Authentication
Generating Authorization header signatures for custom HMAC-authenticated microservice endpoints.
Session & Token Integrity
Validating that cookies, tamper-evident URL parameters, or signed tokens have not been forged.
Frequently Asked Questions
- Are my secret keys sent to your servers?
- No. Your secret keys and message payloads never leave your browser. All cryptographic operations occur directly in client memory using the W3C Web Crypto API.
- What is the difference between a standard hash and an HMAC?
- A standard hash (like SHA-256) only verifies data integrity. Anyone can recalculate a hash if they change the message. An HMAC incorporates a secret key, meaning only parties who know the private key can generate or verify the signature, ensuring authenticity.
- Which algorithm should I use for modern applications?
- HMAC-SHA-256 is the industry standard for webhooks, JWT signing, and cloud APIs. HMAC-SHA-512 is recommended for higher security margins.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind HMAC Generator with our deep-dive educational content.