HMAC Generator
Generate or verify HMAC-SHA256 / SHA512 message authentication codes live — hex + Base64, in-browser. The secret never leaves your machine.
About this ToolHow it works, benefits & use casesTap to collapse
Compute or verify HMAC message authentication codes directly in the browser using the Web Crypto API. Enter a message and a secret key and the tool produces the HMAC live — no submit step — rendered in both hexadecimal and Base64, each with its own copy button. You choose between HMAC-SHA256 and HMAC-SHA512, and a "Random key" button can mint a 32-byte secret for you. Switch to Verify mode to check an expected HMAC against your message and key: paste the hex value and a green or red banner tells you instantly whether it matches, which is the safe way to confirm a signature rather than eyeballing two strings. Crucially, the secret key never persists — it lives only in memory, is never written to local storage, and is never included in the shareable URL (the message and algorithm are). HMAC is the standard for authenticating webhooks, API requests and tokens, and everything here happens on your machine.
How to Use
- 1Choose Generate or Verify with the mode toggle.
- 2Enter the message to authenticate (or click "Load example" to fill in a sample message and key).
- 3Type your secret key, or click "Random key" to generate a 32-byte one — the key is never saved.
- 4Select the algorithm: HMAC-SHA256 or HMAC-SHA512.
- 5In Generate mode, copy the resulting hex or Base64 HMAC; in Verify mode, paste the expected hex HMAC and read the live match/no-match banner.
Key Benefits
- Computes HMAC-SHA256 and HMAC-SHA512 with the native Web Crypto API
- Live output — the HMAC updates as you edit the message, key or algorithm
- Results in both hex and Base64, each one click to copy
- Verify mode confirms an expected HMAC with a clear match/no-match banner
- Built-in random 32-byte secret-key generator
- The secret key stays in memory only — never persisted or put in share links
- Message and algorithm are shareable via URL while the key remains private
Common Use Cases
- Reproducing a webhook signature (e.g. Stripe or GitHub style) to debug verification
- Signing or checking API request payloads that use HMAC authentication
- Verifying that a received HMAC matches what your key and message should produce
- Generating a quick HMAC for testing token or message-integrity logic
- Comparing HMAC-SHA256 versus HMAC-SHA512 output for the same message and key
The data to authenticate · live
Enter a message and secret key — the HMAC updates live.
Security: the secret key stays in memory only — never persisted or included in share links. Anyone with the key can forge valid HMACs.
Was this tool helpful?
Share Your Experience
Help others discover this tool!
Related tools
- Base64 Encoder/DecoderEncode and decode Base64 strings
- Hex to TextConvert hexadecimal to text
- Hash GeneratorGenerate MD5, SHA-1, SHA-256, SHA-512 hashes
- Random Bytes GeneratorGenerate cryptographically secure random bytes
- UUID GeneratorGenerate v4 UUIDs
- Bcrypt Hash GeneratorGenerate bcrypt hashes for passwords
HMAC (Hash-based Message Authentication Code) combines a secret key with a message to produce a code that proves both the message's integrity and that it came from someone holding the key. It is widely used to sign webhooks, API requests and tokens, because an attacker who alters the message cannot recompute a valid HMAC without the key.
You can choose HMAC-SHA256 or HMAC-SHA512, both computed through the browser's Web Crypto API. SHA-256 is the common default for webhooks and APIs; SHA-512 produces a longer code if your system requires it.