HMAC Generator

Compute HMAC signatures for API authentication and webhook verification. The secret key is treated as a UTF-8 string (not hex-decoded). Enter your key, paste the message, and click Run.

  • Runs entirely in your browser
  • No data stored or sent to a server
  • Free forever — no signup
  • Instant conversion

Input and Output

Use the interactive encoder and decoder on this page to process your text.

Learn more about HMAC

How to Generate HMAC Signatures

HMAC Generation

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a message to produce a signature. APIs use HMAC for webhook verification, request signing, and integrity checks where both parties share a secret.

Common Use Cases

  • Verifying GitHub or Stripe webhook signatures
  • Debugging AWS Signature Version 4 components
  • Testing API authentication during development

Common Mistakes

  • Hashing the message before HMAC when the API expects raw body bytes
  • Wrong encoding — UTF-8 vs Latin-1 changes the signature
  • Comparing signatures without constant-time comparison in production code

Developer Tips

  • Node.js: crypto.createHmac('sha256', key).update(msg).digest('hex')
  • Match the algorithm your API documents (usually HMAC-SHA256)
  • Clear secret keys from the page after testing on shared machines

Frequently asked questions

Which HMAC algorithm should I use?

HMAC-SHA256 is the most common default. Use the algorithm specified by the API you are integrating with.

Is my secret key sent anywhere?

No. The key and message are processed entirely in your browser. Clear the page when finished if on a shared machine.