HMAC Generator

A plain hash proves that data has not changed, but it does not prove who produced it: anyone can hash the same data and get the same digest. HMAC — Hash-based Message Authentication Code — solves that by mixing a secret key into the hash, so only someone holding the key can produce or verify the result. That is why HMAC-SHA256 underpins API request signing, webhook verification, JSON Web Token signatures and session tokens across the web. This generator computes HMAC-SHA256 in your browser using the Web Crypto API: enter a secret key and a message, and it returns the hexadecimal authentication code. It is ideal for testing webhook signatures, debugging API clients, and learning how keyed hashing works. Keep real production keys out of any browser tool — use test keys here, and treat anything pasted into a web page as potentially seen.

How to Use the HMAC Generator

1. Enter the secret key exactly as your API or webhook provides it.
2. Enter the message to authenticate — the exact payload or string to sign.
3. Press Generate HMAC and read the hexadecimal code.
4. Compare the code with the signature your API or webhook sent.
5. Press Copy HMAC to use the code in your test or client.

Key Features

• Standard HMAC-SHA256 via the Web Crypto API
• Hexadecimal output, the form most APIs use
• Exact-byte handling: spaces and punctuation matter and are preserved
• One-click copy for test comparisons
• Free, instant and no sign-up

Best Practices and Tips

• Use test keys here, never production secrets: anything typed into a browser tool should be treated as exposed.
• Signatures must match byte-for-byte: a trailing newline or different key encoding breaks verification.
• If a webhook signature fails, check whether the provider signs the raw body or a canonical string — the two differ.
• Compare signatures in constant time in real code to avoid timing attacks; this tool is for testing, not production verification.
• Store keys in environment variables or secret managers, never in source code or chat logs.

Common Mistakes to Avoid

• Pasting a production secret into a browser tool and assuming it stays private.
• Hashing a pretty-printed message when the sender signed the raw, unformatted body.
• Trimming whitespace from the message before signing, which changes the HMAC.
• Using a plain hash where an HMAC is needed, which authenticates nothing about origin.

Frequently Asked Questions

What is HMAC?

HMAC is a method for combining a secret key with a hash function — here SHA-256 — to produce a message authentication code. Only key holders can create or verify the code, so it proves both that the message is unchanged and that it came from someone holding the key.

How is HMAC different from a plain hash?

A plain SHA-256 hash depends only on the message, so anyone can recompute it. An HMAC also depends on the secret key, so an attacker who can change the message still cannot forge a valid code without the key.

Why does my HMAC not match the API signature?

The usual causes are a different key, a different message encoding, or signing a different string than the provider did — raw body versus a canonical string, or a trailing newline. Compare the exact bytes on both sides.

Is HMAC-SHA256 secure?

Yes, when used with a strong, secret key and a correct implementation. HMAC-SHA256 remains widely trusted for API signing and webhook verification, and this tool computes it with the browser Web Crypto API.

Should I use real production keys here?

No. Use test keys for experimentation. Production secrets belong in a secret manager or environment variable, never pasted into a web page.

Related Tools

• MD5 Hash Generator – MD5 digest for any text, computed in-browser
• SHA-256 Hash Generator – creates SHA-256 fingerprints of text using the Web Crypto API
• JWT Decoder – decodes JWT headers and payloads into readable JSON, locally
• JWT Encoder – Builds a signed JWT from header, payload and secret