HMAC Generator
Generate HMAC using your secret key for message authentication
About the HMAC Generator
This HMAC generator produces a keyed message authentication code using SHA-256, SHA-384 or SHA-512. Unlike a plain hash it requires a secret key, which is what proves a message came from someone holding that key.
An HMAC generator combines a message with a secret key to produce a code that only someone holding the key could have generated. That is the difference from a plain hash: anyone can hash a message, but only a key holder can produce a valid HMAC for it.
This is how signed webhooks work. Stripe, GitHub, Shopify and most other providers sign each payload with a shared secret and send the HMAC in a header; your endpoint recomputes it and compares. If they match, the request genuinely came from the provider and was not altered in transit.
Two practical notes. Compare HMACs with a constant-time comparison in production code, since a naive character-by-character check leaks timing information. And keep the secret secret — an HMAC is only as trustworthy as the key, so a leaked secret means anyone can forge valid signatures.
How to use the HMAC Generator
- Enter the message. Paste the exact payload to be signed or verified.
- Enter the secret key. Provide the shared secret. It must match exactly.
- Choose the algorithm. Pick SHA-256, SHA-384 or SHA-512 to match the provider.
- Compare the code. Check the generated HMAC against the signature you received.
HMAC Generator features
- HMAC with SHA-256, SHA-384 and SHA-512
- Hexadecimal output for header comparison
- Suitable for webhook signature verification
- Exact message and key handling
- Instant results as you type
- Runs entirely in your browser
Frequently asked questions
How is HMAC different from a plain hash?
HMAC requires a secret key. Anyone can hash a message, but only a key holder can produce a valid HMAC for it.
What is HMAC used for?
Signing and verifying API requests and webhooks. Providers like Stripe and GitHub sign payloads so your endpoint can confirm they are genuine.
Why does my HMAC not match the provider's?
Usually the message differs by a byte — trailing whitespace or a re-serialised body. Sign the exact raw payload received.
Should I compare HMACs with a normal string comparison?
Not in production. Use a constant-time comparison, since a character-by-character check leaks timing information.
Is my secret key uploaded?
No. The HMAC is computed in your browser, so the key never leaves your machine.