HMAC (Hash-based Message Authentication Code) is a way to sign messages using a secret key and a hash function such as SHA-256.

Which algorithms are supported?

You can use sha-1, sha-256, sha-384, or sha-512, matching many API and webhook signing schemes.

Is this safe for real secrets?

The tool runs in your browser using the Web Crypto API, but you should still avoid pasting production secrets into untrusted sites.

HMAC Generator | Security Tools

How to use HMAC Generator

On the first line, enter the hash algorithm (sha-1, sha-256, sha-384, or sha-512).
On the second line, enter your secret key.
On the remaining lines, enter the message you want to sign, then click Generate to get the HMAC hex digest.

Example

Input

sha-256
my-secret-key
message to sign

Output

e3b0c44298fc1c149afbf4c8996fb92427ae41e4...

Frequently asked questions

What is HMAC?: HMAC (Hash-based Message Authentication Code) is a way to sign messages using a secret key and a hash function such as SHA-256.
Which algorithms are supported?: You can use sha-1, sha-256, sha-384, or sha-512, matching many API and webhook signing schemes.
Is this safe for real secrets?: The tool runs in your browser using the Web Crypto API, but you should still avoid pasting production secrets into untrusted sites.

Embed this tool

Add HMAC Generator to your own site, blog post, or internal docs — free, no signup. The widget runs entirely in your visitors' browsers, same as it does here.