HMAC Generator
Type a message and a secret key and get the keyed hash back in both hex and base64. Pick SHA-1, SHA-256, SHA-384 or SHA-512 and the signature updates on every keystroke. It runs in your browser.
This HMAC generator signs any message with a secret key and shows the result the moment you type. It’s the same HMAC-SHA256 online calculation an API uses to prove a request wasn’t tampered with — you supply the payload and the shared secret, and the tool returns the MAC in hex and base64. Switch between SHA-1, SHA-256, SHA-384 and SHA-512 to match whatever the other side expects. The signing is done natively with the Web Crypto API, so your secret never leaves the tab.
The MAC recomputes on every keystroke — no button to press.
——How it works
- 1
Enter the message and key
Put the payload you want to authenticate in the message box and your shared secret in the key field.
- 2
Choose the hash
Pick SHA-1, SHA-256, SHA-384 or SHA-512 so the signature matches what your API or webhook uses.
- 3
Copy the signature
Grab the hex or base64 form with one click and drop it into your request header or test.
Instant & 100% private — nothing is uploaded
Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.
Frequently asked questions
- What does this HMAC hash tool actually compute?
- It runs HMAC — a hash keyed with your secret — over the message you enter. The same message and key always produce the same signature, which is how a server checks that a request came from someone who knows the secret.
- How do I generate an HMAC signature for a webhook?
- Paste the raw request body into the message box, put the webhook’s signing secret in the key field, and pick the algorithm the provider documents (usually SHA-256). The hex output is the signature most providers send in a header.
- What’s the difference between the hex and base64 output?
- They’re two encodings of the exact same bytes. Some APIs expect the signature as a hex string, others as base64 — copy whichever one your integration asks for.
- Is my secret key sent anywhere?
- No. The HMAC is calculated locally with the browser’s built-in Web Crypto API. Nothing you type is uploaded or logged.
- Which algorithm should I use?
- SHA-256 is the common default and a good choice unless a service specifically asks for another. SHA-1 is offered for older systems; SHA-384 and SHA-512 give longer signatures.
More tools
More from the Hivly network
Free sister tools on our other sites.
