HMAC Generator (SHA-1 / 256 / 384 / 512)
Compute HMAC signatures with Web Crypto — sign webhook payloads, verify API requests, hex or base64 output.
Enter a message and key.
How to use
- Paste the message and the key.
- Pick key encoding (UTF-8 is most common; Stripe uses UTF-8, GitHub uses UTF-8, AWS SigV4 uses derived hex keys).
- Choose algorithm and output format — the result updates live.
About this tool
ShowHide
Compute an HMAC over a message with a secret key, using SHA-1, SHA-256, SHA-384 or SHA-512 and reading the result as hex or Base64. HMAC is not simply a hash of the key joined to the message: it is a specific two-pass construction, and that structure is what protects it from the length-extension attack that makes a naive hash of secret plus message unsafe. That is why webhook signatures from payment processors and Git hosts are HMACs. The setting that decides whether your signature matches theirs is the key encoding: a secret that is really a string of hex or Base64 bytes gives a completely different result if it is read as UTF-8 text. Signing uses the browser's WebCrypto, and neither the key nor the message leaves the page.
Frequently asked questions
Which algorithm should I use?
HMAC-SHA256 is the modern default — used by Stripe, GitHub, Shopify, AWS SigV4. Avoid SHA-1 for new code (though it's still safe against HMAC attacks; just not future-proof).
Why are key encodings needed?
Some APIs give you the secret as a Base64 or Hex string. Treating those as UTF-8 produces a different signature than the server computes. Match the encoding of the published secret.
Is hex vs Base64 output meaningful?
Each API expects one — GitHub wants hex prefixed with sha256=, Stripe wants hex too, Slack wants hex, AWS uses hex. Base64 shows up in some custom protocols.
Can this verify a signature?
Indirectly — compute the HMAC of the message/key, then compare to the expected signature. For safety, do that comparison in constant time (which a browser's === is not).
Guides on this topic
Related tools
Hash Generator (SHA)
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text.
Developer
PBKDF2 Key Derivation
Derive a key from a password with PBKDF2-HMAC in your browser — pick the hash, iteration count and output length, and read the result as hex or Base64.
Developer
File Hash (Checksum)
Compute SHA-1, SHA-256, and SHA-512 checksums of any file.
File
BLAKE3, BLAKE2 & Keccak-256 Hash Generator
Hash text, hex or a file with BLAKE3 (hash, keyed, derive-key), BLAKE2b/2s with key, salt and personalization, Keccak-256/512 or SHAKE128/256.
Developer
JWT Generator
Build and sign HS256 / HS384 / HS512 JWTs from a header and payload — pairs with the JWT Decoder.
Developer
UUID v5 Generator
Generate a deterministic, namespace-based UUID (version 5, SHA-1) from a namespace and a name — the same inputs always produce the same UUID.
Developer