HMAC Generator - Free Online Hash Tool

HMAC‑SHA‑256

256 bit · 64 hex

HMAC‑SHA‑512

512 bit · 128 hex

HMAC‑SHA‑384

384 bit · 96 hex

HMAC‑SHA‑1

160 bit · 40 hex

Quick Presets

✏️

Custom

Blank slate — enter your own message and key

🔗

Webhook

Verify GitHub / Stripe / Shopify webhook payloads

🌐

API Auth

Sign API requests with timestamp + method + path

🎫

JWT Header

Produce the HMAC signature portion of a JWT

🍪

Cookie Sign

Sign session cookies for tamper detection

📄

File MAC

Authenticate file content with a shared secret

Secret Key

Show key

          0
         
         chars  ·
         
          0
         
         bits entropy  ·
         
          —

Key encoding

Random key length:

output as Hex

Message

Message / Payload 0 chars · 0 bytes

Message encoding

HMAC Signature

Enter a key and message, then click Generate HMAC

All Algorithms

Click "Generate All" to compute all four HMAC variants simultaneously.

HMAC — How It Works & When to Use It

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key: HMAC(K, m) = H((K⊕opad) ∥ H((K⊕ipad) ∥ m)) . Unlike a plain hash, it provides both integrity and authenticity — only someone with the key can produce or verify the signature.

Webhook Verification

GitHub, Stripe, Shopify and most major APIs use HMAC-SHA-256 to sign webhook payloads. The platform signs the raw request body with a shared secret and sends the result in a header like X-Hub-Signature-256 . Your server recomputes the HMAC and compares.

JWT Signing

JSON Web Tokens use HMAC-SHA-256 (HS256) to sign the header + payload. The signature is computed over base64url(header) + "." + base64url(payload) with a secret key, then appended as the third JWT segment. This tool lets you reproduce that signature manually.

Constant-Time Verify

This tool uses crypto.subtle.verify() for signature verification, which performs constant-time comparison internally — preventing timing side-channel attacks that could leak whether signatures partially match. Never use string equality ( === ) to compare HMACs in production.