HMAC Generator
Generate HMAC signatures using SHA-1, SHA-256 or SHA-512. Processed entirely in your browser.
HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a code that verifies both the integrity AND authenticity of a message - proving it came from someone who knows the secret key and wasn't tampered with. This tool generates HMAC SHA1/SHA256 hashes from a message and key.
Frequently asked questions
A regular hash only proves data integrity (that it wasn't altered) but anyone can compute it. HMAC additionally requires a secret key, so it proves the message came from someone who knows that key - adding authentication on top of integrity verification.
API request signing (verifying a request genuinely came from an authorized client), webhook payload verification, and various authentication protocols where you need to confirm both integrity and origin of a message.
Computation happens in your browser, but as a general precaution, avoid pasting production secret keys into any third-party tool - use a test key when just learning or debugging HMAC behavior.