HMC
HMAC Generator
Create an HMAC signature for a message.
Ad · Large Rectangle (336×280)
How to use HMAC Generator
Create an HMAC signature for a message.
- Enter the message you want to sign in Your text, and the shared secret in Secret key.
- Pick SHA-256, SHA-1 or SHA-512 from the Algorithm menu.
- Press Run to sign the message with the Web Crypto API and copy the digest.
When you actually reach for this
- You need to sign a request or webhook so the receiver can verify it came from you and was not altered.
- You are implementing the HMAC auth a payment gateway or API requires, using a shared secret.
Where this tool stops being accurate
- HMAC proves integrity and authenticity with the shared secret, but it does not encrypt the payload — the body stays readable.
- If the secret leaks, signatures are forgeable; rotate keys and keep them out of client-side code and logs.
Frequently asked questions
What does HMAC Generator do?
Create an HMAC signature for a message.
HMAC vs hashing — which do I need for API auth?
Use HMAC when both sides share a secret and you must prove the message is untampered and from the right party. A plain hash cannot prove authorship without the secret.
Why does my signature not match the server's?
Usually a different algorithm, encoding (hex vs base64), or a trailing newline in the signed message. Match the exact string and encoding the spec defines.