Skip to main content

Authorized use only. Use this tool solely on systems, tokens, and assets you own or are explicitly permitted to test — credential extraction, signature forging, and unauthorized access are prohibited by our Acceptable Use Policy.

HMAC Generator

Generate HMAC

About the HMAC Generator

HMAC (Hash-based Message Authentication Code) verifies both the integrity and authenticity of a message. APIs use HMAC signatures to ensure requests came from an authorized source and were not tampered with in transit.

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512. Paste your message and secret key — the HMAC is computed instantly in your browser. Common use cases include Stripe webhook verification, AWS API signing, and JWT HS256 tokens.

How to use

  1. Paste the message you want to sign.
  2. Enter your secret key.
  3. Select the hash algorithm (SHA-256 is most common).
  4. Copy the HMAC signature for your API request or verification.

Frequently Asked Questions

How is HMAC different from a hash? ▾

A hash (like SHA-256) only verifies data integrity — anyone can compute it. HMAC requires a secret key, so it verifies both integrity AND authenticity — only someone with the key could have produced the signature.

Where is HMAC used? ▾

Stripe webhook signatures (hex-encoded HMAC-SHA256), AWS API request signing (SigV4), JWT HS256 tokens, and GitHub webhook payloads all use HMAC.