HMAC Generator
Online HMAC message authentication code generator. Enter a message and key, choose SHA-256, SHA-1, SHA-512 or MD5, and see the HMAC computed in real time for API request signing and message integrity checks.
FreeOnline Tool
Loading…
How to Use
- Enter the original content in the message box
- Enter your key in the key box
- Choose a hash algorithm (SHA-256 is the recommended default)
- The resulting HMAC value appears below and updates as you type
Features
- Computes HMAC using SHA-256 (recommended), SHA-1, SHA-512 or MD5 (insecure, kept for legacy compatibility)
- Recalculates in real time whenever the message or key changes, with no button to press
- The algorithm dropdown marks MD5 as insecure to steer you toward SHA-256 or SHA-512
Use Cases
Debugging API request signatures
Many platform APIs, including payment and cloud services, require request parameters to be signed with HMAC. Use this to check that your signing logic is correct.
Verifying webhook callbacks
When receiving a third-party webhook, recompute the HMAC with the same key and algorithm and compare it against the signature in the request to confirm the source.
Learning message authentication
Enter messages and keys and watch the output to understand how HMAC delivers both integrity and origin authentication.
Generating integrity check values
Attach an HMAC to a transmitted message so the recipient can recompute it with the shared key and detect tampering.
FAQ
How does HMAC differ from an ordinary hash?
Anyone can compute a plain hash such as SHA-256 over text, so it proves nothing about who produced it. HMAC mixes a secret key into the computation, so only parties holding the key can produce the correct value. That gives HMAC both integrity checking and authentication, which is why it is used for API signatures.
Which hash algorithm should I pick?
SHA-256 is the widely accepted secure default. SHA-512 is stronger but slightly more expensive. MD5 has known weaknesses and should only be used when integrating with a legacy system that requires it, and SHA-1 is likewise too weak for new systems.
How should I look after the key?
Treat an HMAC key like a password: never hard-code it in front-end code or commit it to a public repository. This tool computes locally and neither stores nor uploads whatever key you enter.
Is the computed HMAC sent to a server?
No. Everything runs locally in the browser and neither the message nor the key is uploaded, though you should still be careful with production secrets.