HMAC Generator

How to use

1. 1Pick an algorithm (HMAC-SHA-256 by default), then choose Generate or Verify signature.
2. 2Paste your secret key and message. Switch the per-input encoding between UTF-8 text, Hex, or Base64 to match how your key was delivered.
3. 3Read the hex, Base64, and Base64 URL-safe signatures in the result panel and click Copy on any row.
4. 4In Verify mode, paste an expected signature to run a constant-time comparison and see a match, length mismatch, or invalid encoding verdict.

About this tool

HMAC Generator computes Hash-based Message Authentication Codes using the Web Crypto API in your browser. Pick an algorithm (HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512), paste a secret key and a message, and the tool returns the signature in lowercase hex, UPPERCASE hex, standard Base64, and URL-safe Base64 at the same time. Each input accepts UTF-8 text, hex, or Base64, which matters for real-world signing flows where keys are often delivered as random bytes encoded in hex (Stripe, AWS) or Base64 (Slack, Shopify), and where the message body may already be a binary payload. A built-in Verify mode lets you paste an expected signature (hex or Base64, with the sha256= prefix automatically tolerated) and runs a constant-time comparison that returns match, mismatch, or length mismatch. Constant-time matters: a naive comparison leaks information about how many leading bytes match, which is exactly the side-channel webhook attackers look for. Useful for signing and verifying webhooks (GitHub, Stripe, Shopify, Slack, Twilio, Mailgun), generating AWS Signature v4 string-to-sign components, signing API requests, computing HOTP/TOTP intermediate values, validating JWT HS256/HS384/HS512 signatures by hand, and any place a developer needs an HMAC. Loaded samples include the canonical RFC 4231 test vectors so you can confirm the implementation matches the standard. Computation runs entirely in your browser, so the secret keys and message bodies you paste never leave your device.

Free to use. Works in your browser. No signup, no login.