Developer Tools
HMAC Generator
Paste a secret key and a message, pick an algorithm — HMAC-SHA1, SHA256, SHA384, or SHA512 — and get the signature in hex or Base64. Perfect for API request signing, webhook verification, and session tokens. Runs entirely in your browser.
What makes this tool different
All major algorithms
Generate HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 signatures.
Hex and Base64
Output the signature in either hex or Base64 to match whatever your API expects.
Web Crypto powered
Signing uses the browser's built-in crypto.subtle — no dependencies, no data sent anywhere.
Live updates
The signature recomputes instantly as you type, so verifying against a known value is trivial.
About this tool
HMAC Generator: everything you need to know
HMAC is the workhorse of API authentication. When your client sends a signed request — to AWS, Stripe, GitHub, or your own backend — it computes an HMAC of the payload with a shared secret, and the server recomputes it to verify authenticity. Getting the algorithm and encoding right is critical, because a single mismatched byte means a rejected request.
This HMAC generator makes signing painless. Enter your secret and message, choose between HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512, and pick hex or Base64 output. The signature recomputes live as you type, so you can test against a known-good value immediately.
Signing happens in your browser using the Web Crypto API, so your secret key never leaves your device. There is no server, no upload, and no logging of your keys — which is exactly how a tool that handles secrets should behave.
HMAC verification is equally important. When your webhook handler or backend receives a signed payload, recompute the expected HMAC from the shared secret and the raw body, then compare it to the X-Hub-Signature or Authorization header. Use this tool to confirm the exact expected value during development.
Because HMAC uses a shared secret, protecting that key matters more than anything. Never hard-code it, rotate it regularly, and keep it out of client-side code. This tool helps you generate and verify signatures, but the secret itself should always live in server-side environment variables or a secrets manager.
Whether you are implementing AWS Signature V4, verifying Stripe webhooks, or signing your own API requests, the HMAC math is the same. Generate a signature here, paste it into your code as a test fixture, and ship with confidence.
FAQ
HMAC Generator — frequently asked questions
What is an HMAC and how does it differ from a plain hash?
HMAC (Hash-based Message Authentication Code) is a hash computed with a secret key. Unlike a plain hash like SHA-256, you cannot recompute or forge an HMAC without knowing the key, which makes it a message authentication code — it proves both integrity and that the signer knows the secret.
How do I generate an HMAC-SHA256 for an API signature?
Take your secret key and message, run them through HMAC with SHA-256, and format the result as hex or Base64. This tool does exactly that in your browser — paste the key and message, pick SHA256, and copy the signature.
What is HMAC Base64 vs hex output?
Both encode the same raw signature. Hex uses two characters per byte (double the length), while Base64 is more compact. APIs differ in which they expect — this tool lets you switch between the two formats with one click.
Why does HMAC need a secret key?
The key is what makes the MAC unforgeable. Anyone can compute a plain hash, but only parties that share the secret can produce the same HMAC. That is why APIs sign requests with HMAC — the server recomputes it with the shared secret and rejects anything that does not match.
Where is HMAC used?
HMAC is everywhere in API security: AWS Signature V4, Stripe webhook signatures, GitHub's signed payloads, OAuth, and session tokens. It authenticates that a request came from a party holding the shared secret and that the payload was not tampered with.
What is the difference between HMAC-SHA1 and HMAC-SHA256?
Both are HMAC constructions; the difference is the underlying hash (SHA-1 vs SHA-256). SHA-1 is older and weaker for collision resistance, though HMAC-SHA1 is still considered safe for authentication. SHA-256 is the modern default and what most new APIs require.
How do I generate HMAC in Python?
Use the hmac and hashlib modules: hmac.new(secret_bytes, message_bytes, hashlib.sha256).hexdigest(). The same HMAC-SHA256 value this tool generates can be reproduced with that one-liner.
Is the HMAC generator free and private?
Yes. OpenToolLab's HMAC generator is completely free, requires no signup, and computes signatures in your browser — your secret key never leaves your device.
Keep exploring