HMAC Generator
Sign messages with HMAC-SHA256 or HMAC-SHA512, entirely in your browser
The computation runs in your browser using the Web Crypto API. Your key and message are never transmitted.
Everything runs in your browser. Your data never leaves your device.
Related tools
How to use
HMAC binds a secret key to a message digest, so only someone who knows the key can produce or verify the same signature. It is widely used wherever two parties need to authenticate messages without full public-key infrastructure.
Enter the message
Paste the text you want to sign into the message field. For API signing this is typically the HTTP method, path, and body concatenated in a canonical format defined by the API provider.
Enter the secret key
Type or paste the shared secret key. Keep this value private — anyone who knows the key can produce valid HMACs. The key field masks input by default to reduce accidental exposure.
Choose the algorithm and copy the digest
Select HMAC-SHA256 for maximum compatibility or HMAC-SHA512 for a longer digest. The hex output updates immediately. Copy the result and use it as the signature in your API request header or webhook comparison.
Examples
Verifying a GitHub webhook
GitHub signs webhook payloads using HMAC-SHA256 with your webhook secret as the key. Paste the raw request body as the message and your secret as the key to reproduce the expected signature and compare it against the X-Hub-Signature-256 header.
Signing an AWS-style API request
Many APIs require signing a canonical request string with a derived key using HMAC-SHA256. This tool lets you verify the intermediate HMAC step manually when debugging a custom signing implementation that produces an unexpected signature.
About this tool
Compute an HMAC (Hash-based Message Authentication Code) by combining a message with a secret key using HMAC-SHA256 or HMAC-SHA512. HMAC is the standard mechanism for API request signing, webhook payload verification, and session token integrity checks. The output is a lowercase hexadecimal digest. Everything runs in the browser via the Web Crypto SubtleCrypto API — your message and secret key are never transmitted to any server.