HMAC Generator

The HMAC Generator computes Hash-based Message Authentication Codes using HMAC-SHA256 or HMAC-SHA512 — the RFC 2104 construction that combines a secret key with a hash function to produce a message authentication tag verifying both message integrity and origin authenticity simultaneously. HMAC is the standard authentication mechanism for REST API request signing, webhook payload verification, JWT HS256 and HS512 signatures, and TOTP seed derivation. The tool computes HMAC in your browser using the Web Crypto API, ensuring the secret key never leaves your device.

Browse all Developer tools

How to Use

Enter your message (the data to authenticate) and the secret key — both can be entered as UTF-8 text or hex bytes. Select the hash algorithm: HMAC-SHA256 produces a 32-byte (64 hex character) tag and is the most widely required; HMAC-SHA512 produces a 64-byte tag with a higher security margin. Click Generate to compute the HMAC tag, displayed in both hex and Base64 encoding for compatibility with different API authentication schemes.

Common Use Cases

• •Backend developers computing HMAC-SHA256 signatures for AWS Signature Version 4 request signing, Stripe webhook verification, or GitHub webhook payload validation
• •API developers manually computing and verifying HMAC authentication tags during development and debugging to ensure their signing implementation produces the correct output before integration testing
• •Security engineers generating HMAC-SHA512 message authentication codes for high-security inter-service communication channels where SHA256 truncation is considered insufficient
• •Frontend developers debugging OAuth 1.0a signature base strings and HMAC-SHA1 signature computation to diagnose authentication failures with legacy API providers
• •Cryptography students learning the RFC 2104 HMAC construction by experimenting with different messages, keys, and algorithms to observe how any change in key or message produces a completely different tag

Take a break and play free browser games