HMAC Generator

What this tool does

An HMAC is what proves a message came from someone holding the shared secret and arrived unchanged: webhook providers sign their payloads with one, API gateways expect one on every request, and a signed URL is usually an HMAC over the path and an expiry. What goes wrong is rarely the algorithm and almost always the key, because a secret printed as hex is bytes rather than the letters a to f, and reading it as text signs something entirely different. Here you say which the key is, all four digests are computed through the browser Web Crypto API, and the result is shown in hex or Base64 so it can go straight into whichever field your provider documents.

How to use it

1. Choose whether your secret key is plain text, hex or Base64.
2. Enter the key and the exact message body to sign.
3. Copy the signature for the digest your provider asks for.

Privacy

This tool runs entirely in your browser. Your input is never uploaded, stored or shared — closing the tab removes it.

Frequently asked questions

Is my secret key sent anywhere?

No. The key is used by your browser Web Crypto implementation inside this page. It is never uploaded, stored or logged, and closing the tab discards it.

Why does my signature not match the one my provider sent?

Almost always the message or the key differs by a byte. Sign the raw request body exactly as it was sent, including whitespace, and check whether the key is hex bytes rather than text.

Should I still use HMAC-SHA1?

Only to interoperate with an older service that requires it. HMAC-SHA1 has not fallen the way plain SHA-1 has, but SHA-256 is the sensible default for anything new.