ToolKitSphereFree Online HMAC Signature Generator
Generate HMAC signatures using SHA-256, SHA-512, SHA-1, or MD5 with a secret key.
Related tools
JWT Token Generator (HS256)
Construct and sign a JSON Web Token using HS256 algorithm and a secret key.
JWT Decoder (Header, Payload, Signature)
Decode and inspect JSON Web Token headers, claims, expiration, and payload data.
SHA-256 Hash Generator
Generate secure 256-bit SHA-256 hashes for cryptographic verification.
SHA-512 Hash Generator
Generate 512-bit SHA-512 cryptographic hashes.
Hash Comparison & File Integrity Verifier
Compare two checksums or hashes side-by-side to verify integrity.
This HMAC generator creates a keyed-hash message authentication code from any text and secret key, supporting SHA-256, SHA-512, SHA-1, and MD5 as the underlying hash function. HMAC is the standard way to prove both the integrity and authenticity of a message — it's what powers webhook signature verification (Stripe, GitHub, Slack), API request signing (AWS SigV4-style flows), and JWT HS256 tokens. Backend developers testing webhook payloads, API integrators verifying signatures, and students learning RFC 2104 will find this tool practical for quick, accurate checks. Both your message and your secret key are processed entirely client-side using the browser's Web Crypto API — nothing is ever transmitted to a server, which matters a great deal since HMAC keys are meant to stay secret. There's no signup, no logging, and the signature recalculates instantly as you type. Pair it with the JWT decoder if you're debugging HS256 tokens. Scroll down to enter your message and key and generate an HMAC signature now.
Features
- Supports HMAC-SHA256, HMAC-SHA512, HMAC-SHA1, and HMAC-MD5
- Accepts a custom secret key of any length
- Instant client-side computation, RFC 2104 compliant
- Hex and Base64 output formats
- One-click copy to clipboard
- Works with arbitrary-length UTF-8 message input
- No server round trip — key never leaves your browser
- Useful for verifying webhook and API request signatures
Why use this hmac generator (all algorithms)?
- Instant signature generation with no processing delay
- Secret keys never leave your device — fully client-side
- Standards-compliant output matching server-side HMAC libraries
- Straightforward for both quick tests and deep debugging
- Free to use with no account or rate limits
Frequently asked questions
What is HMAC used for?
HMAC verifies both the integrity and authenticity of a message using a shared secret key — commonly used for webhook signature verification, API request signing, and JWT HS256 tokens.
Is HMAC-SHA256 secure?
Yes. HMAC-SHA256 is widely trusted and considered secure as long as the secret key is sufficiently long, random, and kept confidential.
What's the difference between a hash and an HMAC?
A plain hash has no secret and anyone can recompute it; an HMAC incorporates a secret key, so only someone who knows the key can generate or verify a valid signature.
Should I use HMAC-MD5 or HMAC-SHA1?
Avoid them for new systems. Even though the underlying hash weaknesses are less severe in the HMAC construction, HMAC-SHA256 or stronger is recommended going forward.
How do I verify a webhook signature with this tool?
Paste the raw payload as the message, enter the shared secret as the key, choose the algorithm the provider specifies (often SHA256), and compare the output to the signature header.
Can HMAC be reversed to reveal the key?
No, HMAC is a one-way function; you cannot recover the secret key or the original message from the signature alone.
Does this tool expose my secret key?
No, the key and message are processed entirely in your browser via JavaScript and never sent to any server.