HMAC Generator
Generate HMAC-SHA256, SHA384, and SHA512 message authentication codes.
About this tool
Generate HMAC-SHA256, SHA384, and SHA512 message authentication codes. Handy for auth debugging, test fixtures, and moving data between transport formats like Base64, URL encoding, and tokens.
Enter the message payload and the shared secret. Choose SHA-256, SHA-384, or SHA-512. Example — HMAC-SHA256 smoke test: try `message: hello secret: test-secret alg: SHA-256` and expect something like `(64-character hex digest)`.
Runs in the browser via Web Crypto — fine for development, not a KMS substitute. See also: Hash Generator, and AES Encrypt / Decrypt. Runs in your browser — nothing you paste gets uploaded.
How to use
- Enter the message payload and the shared secret.
- Choose SHA-256, SHA-384, or SHA-512.
- Generate the hex HMAC for webhook signatures or API request signing tests.
- Compare against the signature your server or provider computes.
Example
HMAC-SHA256 smoke test
Input
message: hello secret: test-secret alg: SHA-256
Output
(64-character hex digest)
Limitations
- Runs in the browser via Web Crypto — fine for development, not a KMS substitute.
- Does not implement provider-specific signing strings (AWS SigV4, Stripe quirks) beyond raw HMAC.
- Never paste production secrets into shared machines or recorded demos.
Related guides
1Related tools
2Frequently asked questions
What does the HMAC Generator do?
Generate HMAC-SHA256, SHA384, and SHA512 message authentication codes. Runs in your browser — no install, no account.
How do I use the HMAC Generator?
Enter the message payload and the shared secret. Choose SHA-256, SHA-384, or SHA-512. Generate the hex HMAC for webhook signatures or API request signing tests. Compare against the signature your server or provider computes.
Is the HMAC Generator free?
Yes. No signup, no usage limits, no paywall.
Does the HMAC Generator upload my data?
No. Processing happens locally in JavaScript. Your input is not uploaded, stored, or logged.
What are the limitations of the HMAC Generator?
Runs in the browser via Web Crypto — fine for development, not a KMS substitute. Does not implement provider-specific signing strings (AWS SigV4, Stripe quirks) beyond raw HMAC. Never paste production secrets into shared machines or recorded demos.