HMAC Generator
Generate HMAC signatures from a message and secret key with SHA-1, SHA-256, SHA-384, or SHA-512.
Message, key, and options
Output
When to use HMAC Generator
Common ways to use HMAC Generator:
- Verify webhook payloads
Generate the same HMAC signature your backend expects before comparing it with an incoming webhook signature.
- Match API signing examples
Recreate documentation examples with the same message, secret key, algorithm, and output format.
- Debug signature mismatches
Change one variable at a time to find whether the payload, key, algorithm, or encoding is causing the mismatch.
- Prepare support tickets
Copy the full labeled signature block into tickets, runbooks, or code review notes for teammates.
- Check signatures on mobile
Run the same message-plus-key workflow on a phone or tablet while troubleshooting away from a desktop.
FAQ
- How do I use HMAC Generator?
- Paste or type the message and secret key, choose the required algorithm and output format, then review or copy the generated signature. Use Clear to reset both fields.
- Is this app free to use?
- Yes. HMAC Generator is free to use and does not require an account.
- What happens to my message and secret key?
- This tool computes signatures locally in your browser and does not upload the message or secret key for app processing. Copied output still goes to your clipboard.
- Why does my signature not match the expected value?
- Check the exact raw payload, secret key, algorithm, output format, and line endings or encoding. Even one byte of difference changes the HMAC result.
- Where can I find instructions and webhook/API tips?
- Open the in-app Help panel for the full workflow, algorithm guidance, paste behavior, and troubleshooting notes. The Help panel is keyboard accessible and Escape closes it.
Help & instructions
How to use HMAC Generator
- Focus the message or secret key field, then type or paste the exact bytes you need to sign.
- Choose the algorithm and output format; the signature updates automatically as you edit.
- Copy the signature block or clear both fields before testing another request.
Tips
- HMAC signs a message with a secret key, so use the exact raw payload bytes and the exact same key bytes as your server.
- SHA-256 is the best default for most new integrations; use SHA-1 only when a legacy system explicitly requires it.
- The tool runs locally in your browser, the paste button targets the last focused field, and Escape closes Help.