HMAC Generator
Enter the message and secret key, pick HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512, then press Generate HMAC. Web Crypto builds a hex digest you can copy for API checks, webhook verification, or learning keyed hashes.
Updated 2026-08-04 · security
About this tool
This HMAC generator imports your secret as a raw key, signs the UTF-8 message with the selected SHA hash under the HMAC algorithm, and prints the signature as lowercase hex. Empty message or secret shows a clear status instead of a digest. A Copy output button appears after a successful run.
How to use
- Open the generator: Load this page so Message, Secret key, Algorithm, and Generate HMAC appear.
- Enter message and secret: Type the payload text and the shared secret key you want to sign with.
- Choose the algorithm: Select HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 from the Algorithm list.
- Generate and copy: Click Generate HMAC, then use Copy output to place the hex digest on the clipboard.
Common use cases
- Recreate an API request signature and compare it with the server’s expected HMAC.
- Verify a webhook payload against the shared secret before trusting the body.
- Teach keyed hashing by comparing digests when the message or secret changes.
Tips
- Both message and secret are required; missing either stops generation with a status note.
- Match the algorithm your API documents; SHA-256, SHA-384, and SHA-512 produce different digests.
FAQ
Which algorithms are supported?
HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 via the browser Web Crypto API.
What format is the output?
A lowercase hexadecimal digest of the HMAC signature, shown in the HMAC (hex) box.
What if message or secret is empty?
Generation stops and the status asks you to enter the missing field.
Does the secret leave my device?
Signing runs in your browser with Web Crypto; you do not need an account.