How do I generate an HMAC online?

Enter your message and secret key above, choose the hash algorithm (SHA-256 is the usual choice), and run the tool. You get the HMAC signature in hex and base64 — free, no signup, computed in your browser.

What is an HMAC calculator used for?

An HMAC calculator creates a message authentication code that proves a message is authentic and unmodified. It is used for API request signing, webhook signature verification (Stripe, GitHub, Slack all use HMAC), and password storage schemes.

What is the difference between HMAC-SHA256 and HMAC-SHA512?

Both are HMAC constructions; they differ only in the underlying hash. SHA-256 produces a 64-character hex digest and is the standard for most APIs. SHA-512 produces a 128-character digest and is preferred when maximum strength is wanted. Both are secure today.

How do I verify a webhook signature with HMAC?

Take the raw request body as the message and your webhook secret as the key, compute the HMAC with the algorithm the provider specifies (usually SHA-256), and compare it — in constant time — with the signature header the provider sent. This tool computes the expected value for you.

Is my secret key uploaded anywhere?

No. The HMAC is computed entirely in your browser using local crypto functions. Your message and secret key never leave your device. Still, avoid pasting real production secrets into any online tool as a habit.

HMAC Generator — Compute HMAC Signatures Online

What is Hmac generator?

HMAC Generator — Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key. No signup, nothing uploaded.

HMAC is computed per RFC 2104 using the platform crypto library (Node.js createHmac in this environment; browsers use the equivalent Web Crypto subtle.sign). The secret key and message are hashed with the selected algorithm, and the digest is rendered as lowercase hex and standard base64. Everything runs locally in your browser — the message and secret are never uploaded. Limitation: SHA-1 is offered for legacy compatibility only; prefer SHA-256 or SHA-512 for anything new.

Why use this hmac generator?

🎯

Built for hmac generator

Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key. No signup, nothing uploaded.

📋

Transparent & honest

Inputs are treated as UTF-8 text; binary keys or messages are not supported by this tool.

🔒

Private by design

Everything runs in your browser. Your inputs never leave your device.

📱

Works everywhere

Fully responsive — perfect on desktop, tablet, and mobile. No app needed.

🔄

Regularly updated

Regularly maintained and reviewed to ensure accuracy.

💡

Free forever

No accounts, no limits, no watermarks. Use HMAC Generator as much as you need.

How to use HMAC Generator

1Type or paste your message into the "Message" box.
2Enter the secret key that both sides of the exchange share.
3Pick the hash algorithm — SHA-256 is the standard choice for API signatures.
4Run the tool to compute the HMAC and get it in hex and base64 formats.
5Compare the output against the signature you received to verify the message is authentic and unmodified.

What can you do with HMAC Generator?

Hmac generator online — Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key.
Hmac sha256 generator — Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key.
Api signature generator — Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key.
Hmac calculator — Free HMAC generator online — compute HMAC-SHA256, SHA-384, SHA-512 or SHA-1 signatures for any message and secret key.

Good to know

Inputs are treated as UTF-8 text; binary keys or messages are not supported by this tool.
SHA-1 is included only for legacy verification — do not use it for new systems.
Output comparison for security decisions should use constant-time comparison in your own code; visual comparison here is for inspection only.

How it works

HMAC is computed per RFC 2104 using the platform crypto library (Node.js createHmac in this environment; browsers use the equivalent Web Crypto subtle.sign). The secret key and message are hashed with the selected algorithm, and the digest is rendered as lowercase hex and standard base64. Everything runs locally in your browser — the message and secret are never uploaded. Limitation: SHA-1 is offered for legacy compatibility only; prefer SHA-256 or SHA-512 for anything new.

Examples

HMAC-SHA256 signature

Status: ok — returns the HMAC-SHA256 of "hello world" with key "secret123" in hex and base64.

HMAC-SHA512 for an API payload

Status: ok — 128-character hex digest suitable for webhook signature verification.

Missing secret

Status: error — a secret key is required; HMAC cannot be computed without one.

People also search for these — this tool handles them all:

hmac generatorhmac generator onlinehmac sha256 generatorapi signature generatorhmac calculator