HMAC Generator

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512 with custom secret keys for message authentication.

HMAC Generator tool

Loading...

Example

Input: Message "what do ya want for nothing?", secret key "Jefe", algorithm SHA-256

Result: 5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

This is RFC 4231 test case 2. HMAC hashes the key-padded message twice (inner and outer pad), giving a 32-byte (256-bit) signature for SHA-256.

HMAC Output Sizes

AlgorithmBytesBitsHex charactersBase64 characters
HMAC-SHA256322566444
HMAC-SHA384483849664
HMAC-SHA5126451212888

Measured from the RFC 4231 test case 2 signatures. Use the length to spot a wrong algorithm or encoding.

  1. Enter the message you want to sign.
  2. Type your secret key into the key field.
  3. Choose the hash algorithm: SHA-256, SHA-384 or SHA-512.
  4. Click "Generate HMAC" to compute the signature in hex. Turn on Uppercase if needed.
  5. Copy the result to compare it with a signature or use it in your request.

HMAC Signatures for Webhooks and APIs

HMAC (hash-based message authentication code) is a signature made from a message plus a secret key. This generator computes HMAC-SHA256, HMAC-SHA384 or HMAC-SHA512 in your browser and shows the result in hex. Use it to check a webhook signature or to test code that signs API requests.

A plain hash shows that data has not changed, but anyone can compute one. HMAC mixes in a shared secret, so only someone who holds the key can make the right value. GitHub and Stripe use HMAC-SHA256 this way. They sign each webhook with your endpoint secret and send the signature in a header. Your server computes it again and rejects the request if the two do not match.

Most mismatches come from the input, not the math. Sign the exact raw body the service sent. Reformatted JSON, an extra newline or a trimmed space changes the result. Some services sign more than the body. Stripe, for example, signs the timestamp, a dot and then the payload. Check the header format as well: GitHub puts sha256= in front of its hex signature, and Shopify sends Base64 instead of hex.

The key and message are read as UTF-8 text. The result shows its length, which is 32 bytes for SHA-256, 48 for SHA-384 and 64 for SHA-512. MD5 and SHA-1 are not offered. The Web Crypto API does the work, so neither the key nor the message leaves your device. For a digest without a key, use the Hash Generator. To read a token signed with HMAC, try the JWT Decoder.

Sources

Frequently Asked Questions

Copy the raw request body exactly as GitHub sent it and paste it as the message. Enter your webhook secret as the key and choose SHA-256. Click Generate HMAC, then compare the result with the X-Hub-Signature-256 header after removing its sha256= prefix. If they match, the payload came from GitHub and was not changed.
Usually the message is not byte-for-byte identical. Pretty-printed JSON, a trailing newline, a different line ending or a missing timestamp prefix all change the result. Next, check the key: if your provider says the secret must be decoded from Base64 or hex first, this tool will not match, because it uses the key text exactly as typed.
A normal hash needs only the message, so anyone can compute or fake one. HMAC also needs a secret key, so only people who know the key can create a valid value. That proves the message came from a key holder and was not changed. HMAC is also built to resist tricks that work against a simple hash of key plus message.
Use whatever the service you are talking to specifies, which is usually SHA-256. For your own systems, HMAC-SHA256 is the standard choice and is more than strong enough. SHA-384 and SHA-512 give longer signatures and a wider safety margin. Avoid HMAC-MD5 and HMAC-SHA1 for new work.
This tool shows hex only, in lowercase or uppercase. Hex and Base64 are two ways to write the same bytes. To convert in Node.js, use Buffer.from(hex, 'hex').toString('base64'); in Python, base64.b64encode(bytes.fromhex(hex)). A SHA-256 HMAC is 64 hex characters or 44 Base64 characters.

Related Tools

Hash Generator

Create MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, right in your browser.

Security and Encryption

Bcrypt Hash Generator and Verifier

Generate bcrypt hashes with configurable rounds and verify passwords against existing bcrypt hashes.

Security and Encryption

Text Encryption and Decryption

Encrypt and decrypt text using AES-256 encryption entirely in your browser. No data sent to servers.

Security and Encryption

JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

Developer Tools

Base64 Encode and Decode

Encode text to Base64 and decode Base64 strings back to readable text, with full UTF-8 support.

Developer Tools

OTP Code Generator and Validator

Generate and validate TOTP codes compatible with Google Authenticator and other authenticator apps.

Security and Encryption