Zap.Tools
By Updated

HMAC Generator

Generate HMAC signatures with SHA-1, SHA-256, SHA-384, and SHA-512 in hex or base64 output

Interactive tool

Inputs

Algorithm
Output
Key encoding

No signature yet

Provide a key and message above to compute the HMAC

What is an HMAC Generator?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to verify both data integrity and authenticity. Unlike a plain hash, HMAC requires the secret key to produce or verify the signature, making it ideal for API authentication, webhook verification, and tamper-evident messaging.

How to Use This HMAC Generator

  1. 1Paste or type your secret key
  2. 2Enter the message you want to sign
  3. 3Choose the hash algorithm (SHA-256 is the most common)
  4. 4Pick output format: hex (default) or base64
  5. 5If your key is hex or base64 encoded, switch the key encoding option
  6. 6Copy the signature for use in headers, webhook validation, or comparison
What you get

Key features

Four SHA Algorithms

HMAC-SHA1, SHA-256, SHA-384, and SHA-512 to match any backend specification

Hex or Base64 Output

Switch output format instantly without re-entering inputs

Flexible Key Encoding

Provide keys as UTF-8 text, hex bytes, or base64 strings depending on the source

SubtleCrypto Backed

Uses the browser native Web Crypto API for fast and trustworthy hashing

Live Computation

Signature recalculates instantly as you tweak the key, message, or options

Bit and Byte Length

See the signature length to confirm it matches what your backend expects

100% Private

Keys and messages never leave your browser. Nothing is uploaded

No Sign Up

Free, unlimited, no registration required

Why Use HMAC?

HMAC is the standard for authenticating API requests, validating webhook payloads, and ensuring data has not been tampered with in transit. Unlike a raw hash, an attacker cannot forge a valid HMAC without the secret key. It is built into AWS Signature v4, Stripe webhooks, GitHub webhook payloads, JWT signing (HS256/HS384/HS512), and most enterprise security stacks.

Common use cases

  • Verifying webhook payloads from Stripe, GitHub, Shopify, and similar services
  • Signing API requests for AWS, Twilio, or custom backends
  • Computing HS256/HS384/HS512 signatures for JWT debugging
  • Generating tamper-evident tokens for short-lived links
  • Comparing expected versus received signatures during integration testing
  • Building offline tools for HMAC validation
  • Educational walkthroughs of MAC schemes
  • Quick checks during security audits

Choosing the Right Algorithm

SHA-256 is the modern default and balances speed and security for almost all use cases. SHA-1 should only be used when a legacy system requires it. SHA-384 and SHA-512 produce longer signatures and are useful in higher-assurance environments or when matching specific backend configurations.

Key Encoding Matters

Different libraries store HMAC keys differently. AWS uses raw bytes derived from a secret. Many SDKs accept hex or base64 keys directly. If signatures do not match a backend, double-check the key encoding option here matches how the backend interprets the key.

Pro tips

Tips & best practices

Use SHA-256 unless told otherwise

It is the most widely supported algorithm and offers strong security for nearly every webhook and API integration

Trim trailing whitespace from keys

Hidden whitespace in copied keys is a common cause of signature mismatch. Paste into the key field and remove trailing whitespace

Match exact byte payload

For webhook verification, sign the exact request body bytes including JSON formatting. Re-serializing JSON often changes the bytes

Compare in constant time

When verifying signatures in code, use constant-time comparison to prevent timing attacks. This generator only computes; equality must be checked safely on your server

Rotate keys periodically

Long-lived HMAC keys increase blast radius if leaked. Rotate keys on a schedule and revoke immediately on incident

Built for trust

Privacy & security

This HMAC generator runs entirely in your web browser using the SubtleCrypto API. Your keys and messages never leave your device, are not stored, and are not transmitted to any server. Use it freely for sensitive workloads.

Related tools

Frequently Asked Questions

What is the difference between HMAC and a regular hash?

A regular hash like SHA-256 takes a single input and produces a digest. An HMAC takes both a message and a secret key, producing a signature that cannot be forged without the key. HMAC is therefore suitable for authentication, while plain hashes are not.

Which HMAC algorithm should I use?

HMAC-SHA256 is the modern default and is widely used by Stripe, GitHub, AWS, and countless APIs. Use SHA-384 or SHA-512 if your backend specifically requires longer signatures. Avoid SHA-1 unless you are integrating with a legacy system that mandates it.

Why does my signature not match my backend?

Common causes are key encoding mismatch (UTF-8 vs hex vs base64), trailing whitespace in the key or message, and JSON re-serialization changing the body bytes. Always sign the exact bytes the backend will validate.

Is hex or base64 better for the output?

Both encode the same bytes; the choice depends on what the receiving system expects. Hex is more common in headers and logs. Base64 is more compact and used by some webhook schemes and JWTs.

Can I use this generator for JWTs?

Yes. The signature portion of HS256, HS384, or HS512 JWTs is exactly an HMAC of the header.payload string. Compute the signature here, base64url-encode it, and append to your JWT. For full JWT decoding and signing, see the JWT Decoder tool.

Are my keys uploaded anywhere?

No. The HMAC generator runs entirely in your browser using the SubtleCrypto API. Your secret keys and messages never leave your device, are not stored, and are not transmitted. The tool is safe to use with sensitive credentials.