HMAC combines a cryptographic hash function with a secret key to provide message authentication. It's used for verifying data integrity and authenticity in APIs, webhooks, and secure communications.
How to Generate an HMAC Signature
- 1
Enter Your Message
Type or paste the message you want to authenticate into the message field. This can be any text, JSON payload, URL string, or raw request body you need to sign. - 2
Provide Your Secret Key
Enter the shared secret key in the secret key field. This key must be known by both the sender and the receiver. Use a strong, randomly generated key for production use. - 3
Select a Hash Algorithm
Choose the HMAC algorithm from the dropdown. HMAC-SHA256 is the most widely used and recommended for most applications. SHA-512 offers stronger security for sensitive data, while SHA-1 is available for legacy compatibility. - 4
Copy Your HMAC Signature
The HMAC signature is generated instantly as you type. Click the Copy button to copy the hex-encoded result to your clipboard. Use this value in your API headers, webhook verification logic, or authentication flow.
Common Use Cases for HMAC
API Request Signing
Webhook Verification
Data Integrity Checks
Token and Session Validation
Why Use HMAC?
HMAC (Hash-based Message Authentication Code) is a specific type of message authentication code that combines a cryptographic hash function with a secret key. It is defined in RFC 2104 and is widely used across the internet for API authentication, webhook verification, and data integrity validation. Unlike a plain SHA-256 hash, which anyone can compute, an HMAC requires knowledge of the secret key, ensuring that only authorized parties can generate or verify the signature.
This free online HMAC generator supports SHA-1, SHA-256, SHA-384, and SHA-512 algorithms. All computation happens entirely in your browser using the Web Crypto API, so your secret key and message data never leave your device. Whether you are debugging a Stripe webhook signature, testing an AWS request signing flow, or building a JWT authentication layer, this tool lets you quickly generate and verify HMAC values without installing libraries or writing throwaway scripts.
HMAC is a cornerstone of modern web security. It underpins the HS256 algorithm used in JSON Web Tokens, the signature scheme for AWS Signature Version 4, and the payload verification system used by payment providers like Stripe and PayPal. If you need to generate cryptographic keys for HMAC signing, try the Random Key Generator. For comparing two HMAC outputs side by side, the Hash Comparison Tool can help you spot mismatches instantly.
How It Compares
HMAC differs from standard hash functions like MD5 or SHA-256 in one critical way: it requires a secret key. A plain SHA-256 hash of a message can be computed by anyone, which means an attacker could modify a message and recompute the hash without detection. HMAC solves this by mixing the secret key into both the inner and outer hash passes, making it computationally infeasible to forge a valid signature without knowing the key.
Compared to digital signatures using RSA or ECDSA, HMAC is symmetric -- both the signer and verifier share the same secret. This makes HMAC faster and simpler for server-to-server communication where both parties can securely exchange a shared key. Digital signatures are preferred when the verifier should not be able to create signatures, such as in public-facing JWT validation scenarios. For most API authentication and webhook verification workflows, HMAC-SHA256 remains the industry standard choice due to its speed, simplicity, and proven security track record.