Online HMAC Signature Generator
Generate a keyed message authentication code using a secret and algorithms such as HMAC-SHA-256, SHA-384 or SHA-512. HMAC values are commonly used to verify webhook signatures, API requests and message integrity.
Both sides must use the same secret, input bytes, character encoding and algorithm. Compare signatures with a constant-time operation in production systems to reduce timing side channels.
Instructions
How to calculate an HMAC
Fill in the Message field with the text or data you want to authenticate, and the Secret Key field with the key shared between the parties. The HMAC is calculated automatically. Select the hash algorithm and the output format according to your application's needs.
Output formats
Hex shows the result in hexadecimal — the most common format for debugging and manual comparison. Base64 is compact and common in HTTP headers such as Authorization. Base64url is the variant without the +, / and = characters, suitable for use in URLs and JWT tokens.
Choosing the algorithm
For most applications, HMAC-SHA-256 is the recommended standard — widely adopted, secure and interoperable. SHA-512 offers more security and is preferred in high-sensitivity contexts. SHA-1 should be avoided in new projects, as it has known vulnerabilities.
What is HMAC
HMAC (Hash-based Message Authentication Code) is a message authentication mechanism that combines a cryptographic hash function with a secret key. Unlike a simple hash, HMAC guarantees not only the integrity of the message (that it has not been altered), but also its authenticity (that it was generated by whoever holds the secret key).
HMAC is defined by RFC 2104 and is widely used in protocols such as JWT (JSON Web Token), where it signs the header and payload, in REST APIs for request authentication (such as the AWS Signature), in webhooks to verify that events originated from the expected platform, and in key exchange protocols such as TLS.
The security of HMAC depends directly on the strength of the secret key used. It is recommended to use randomly generated keys with at least 256 bits of entropy, and never reuse them across different contexts. The key must never travel together with the message — only the resulting HMAC is transmitted for verification.