HMAC Generator
Generate HMAC (Hash-based Message Authentication Code) signatures from text input using a secret key. HMAC provides authentication and integrity verification for messages. Supports multiple hash algorithms including SHA-256, SHA-512, and MD5.
When to use this tool
You need to sign API requests with a shared secret.
You are validating webhook signatures during debugging.
Examples
Sign a payload
Input
Key: secret Message: timestamp=1700000000&body=hello
Output
HMAC-SHA256: 0d3b9f6f1a2c9e4f7b6a2c1d0f3e5a7b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f
Always match the provider’s signing format.
Developer use cases
Generate signatures for REST API authentication.
Verify webhook payload integrity in staging.
Common mistakes to avoid
Using the wrong hash algorithm for a provider.
Signing the wrong string (missing newline or ordering).
Format and behavior notes
HMAC requires both a key and message.
Signatures change if even one byte differs.
Related Tools
Frequently Asked Questions
What is HMAC used for?
HMAC is used for message authentication, API security, digital signatures, and ensuring data integrity in communication.
What hash algorithms are supported?
The tool supports SHA-256, SHA-512, SHA-1, and MD5 hash algorithms for HMAC generation.
Do I need a secret key?
Yes, HMAC requires a secret key to generate the signature. The same key must be used to verify the signature.