SECURITY TOOL
HMAC Generator
Generate an HMAC signature for a message using a secret key.
HMAC (hex)
—
About this tool
Generate an HMAC (Hash-based Message Authentication Code) for a message using a secret key — used to verify both the integrity and authenticity of data, for example when validating webhook payloads. Computed locally using the native Web Crypto API.
Frequently asked questions
- How is HMAC different from a plain hash?
- A plain hash (like SHA-256 alone) only detects if data changed. HMAC combines the message with a secret key, so only someone who knows the key could have produced a matching code — proving both integrity and origin.
- Which algorithm should I choose?
- HMAC-SHA256 is the most common default today (used by many APIs and webhook systems). SHA-1 is older and weaker but still seen in legacy systems; SHA-512 offers a larger output for extra margin.
- Is my secret key sent anywhere?
- No — the entire computation happens locally in your browser via the Web Crypto API; nothing is transmitted.