Useful Hacks

HMAC Generator

Generate an HMAC signature for a message with a secret key.

Computed entirely in your browser. Your secret is never sent anywhere.
  • SHA-1, SHA-256, SHA-384 and SHA-512 via the browser's Web Crypto — real, spec-correct output.
  • Updates live as you change the key, algorithm or message.
  • The key and message never leave your browser.

Why this is private

  • Computed entirely in your browser. Your secret is never sent anywhere.
  • Open your browser's DevTools → Network tab while using this tool — you won't see a request carrying your input, because it never leaves your device.
  • Nothing you enter is uploaded to a server or shared with us — the processing happens entirely on your device.

Overview

Computes an HMAC (Hash-based Message Authentication Code) — used to verify both the integrity and authenticity of a message, since producing a valid HMAC requires knowing the secret key.

How to use it

  1. 1Enter the secret key.
  2. 2Choose a hash algorithm.
  3. 3Enter the message.
  4. 4The HMAC updates automatically.

Tips

  • Only use this for testing and debugging — never paste a real production signing secret into any web-based tool.

Frequently asked questions

What people use it for

Verify a webhook signatureRecompute the HMAC over a payload and compare it to the `X-Signature` header a provider sent.
Build a signed API request in developmentGenerate the signature string an API expects while you wire up the client.
Check your signing code matches the specCompare your implementation's output against this tool's for the same inputs.
Learn how HMAC worksChange one character of the message and watch the whole digest change.

Related tools

All developer tools

Ready to use HMAC Generator?

HMAC Generator

Search tools

Search for any tool by name, category or keyword