HMAC Generator
Free online HMAC generator. Generate HMAC-SHA256 and HMAC-SHA512 authentication codes. Used for API signing, JWT and webhook verification. All processing is local and private.
Enter a message and key. The HMAC updates as you type.
How to Use HMAC Generator
Enter Message & Secret Key
Type the message to authenticate and a secret key. The key should be known only to parties that need to verify the HMAC — it's the shared secret that proves authenticity.
Select Hash Algorithm
Choose SHA-256 (recommended) or SHA-512. SHA-256 is faster and sufficient for most use cases. SHA-512 provides higher security margin.
Copy the HMAC
The HMAC is a hex-encoded authentication code. Send it alongside your message. The receiver can recompute the HMAC with the same key to verify the message hasn't been tampered with.
Frequently Asked Questions
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function (SHA-256 or SHA-512) with a secret key to produce a message authentication code. Unlike a plain hash, HMAC proves both data integrity (the message hasn't changed) and authenticity (it came from someone who knows the secret key). HMAC is used in JWT signing, API authentication, OAuth 1.0, and AWS Signature V4.
HMAC vs plain hash — when to use which?
Use a plain hash (SHA-256) when you only need to verify data hasn't been corrupted — file checksums, deduplication, commit hashes. Use HMAC when you need to verify both integrity AND authenticity — API request signing, webhook payloads, session tokens. Anyone can compute a plain hash. Only someone with the secret key can compute a valid HMAC.
What should I use as the secret key?
Use a cryptographically random string at least 32 bytes (64 hex chars) long. Never use a password directly — run it through a KDF first. Generate keys with our Password Generator or Random String Generator. Store the key securely — if an attacker obtains your HMAC key, they can forge valid HMACs for any message.