HMAC Generator
Generate an HMAC signature using a secret key — free and processed entirely in your browser.
About HMAC Generator
An HMAC is a hash combined with a secret key, used to verify that a message genuinely came from someone who knows that key and wasn't altered in transit — the mechanism behind API request signing, webhook verification (Stripe, GitHub, and others all use HMAC-SHA256), and secure message authentication.
Enter your text or file, your secret key, and choose SHA-256, SHA-384, or SHA-512. Everything runs locally in your browser using the Web Crypto API; your key and data are never sent anywhere.
How to Generate an HMAC
Step 1
Enter your text or file
Type text or upload a file to generate an HMAC for.
Step 2
Enter your secret key
Provide the shared secret key, and choose your hash algorithm.
Step 3
Copy your HMAC
Copy the generated signature.
Frequently Asked Questions
What's the difference between this and your regular Hash Generator?
A regular hash only depends on the input; an HMAC also depends on a secret key, so only someone who knows that key can produce or verify the same signature — useful for authentication, not just integrity checking.
What is this actually used for?
Verifying webhook requests (Stripe, GitHub, and many services sign payloads with HMAC-SHA256), signing API requests, and message authentication where both sides share a secret key.
Is my secret key sent anywhere?
No. Signing happens entirely in your browser using the Web Crypto API.
Which algorithm should I use?
Whichever the service you're working with specifies — SHA-256 is the most common default.