Free HMAC Generator Online

The HMAC Generator is a free online tool that creates Hash-based Message Authentication Code signatures for API authentication and data integrity verification.

Yes, it is completely free with no registration required. All HMAC generation happens client-side in your browser.

HMAC is used to verify both the integrity and authenticity of messages, commonly used in API authentication, webhooks, and secure communication protocols.

Absolutely. The HMAC Generator processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the HMAC Generator is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the HMAC Generator in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The HMAC Generator works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

A plain hash such as SHA-256 takes a message and produces a fixed-length digest, but anyone can recompute it because no secret is involved. That proves a message hasn't changed only if you already trust the digest. HMAC mixes a secret key into the hashing process, so it proves both integrity and authenticity: the signature could only have been produced by someone holding the shared key. An attacker who sees your message still cannot forge a valid HMAC without that key, which is why webhooks and API signing rely on HMAC rather than a bare hash. The name even reflects this -- HMAC stands for Hash-based Message Authentication Code, a hash wrapped around a secret. This tool builds the HMAC for you: enter a message, supply your key, pick an algorithm, and copy the signature in hex or Base64.

For new work, HMAC-SHA256 is the recommended default and the most widely used algorithm in API signing -- Stripe, GitHub, and most modern providers use it. HMAC-SHA384 and HMAC-SHA512 give you larger digests (SHA-512 returns a 64-byte output) if your design calls for a wider security margin. HMAC-SHA1 is included only for legacy compatibility with older systems such as OAuth 1.0; you should not pick it for new designs, because SHA-1's collision weaknesses make it a poor foundation even though HMAC-SHA1 isn't broken in the same way a raw SHA-1 hash is. If you're unsure, start with HMAC-SHA256 and only change to match a provider that demands something else. This tool offers all four algorithms and instantly regenerates the signature when you switch, so you can compare outputs side by side.

Mismatches almost always come from a difference in inputs rather than a broken algorithm, because HMAC is deterministic -- the same message and key always produce the same signature. Check four things. First, the exact message bytes: signing over a parsed or reformatted JSON body instead of the raw payload is the most common cause. Second, the key format: providers issue secrets as plain text, hex, or Base64, and decoding it wrong changes every byte. Third, the output encoding: confirm whether they expect hex or Base64. Fourth, the algorithm and any appended timestamp. This tool lets you control all of these explicitly -- enter the key as text, hex, or Base64, choose the algorithm, and select hex or Base64 output -- then use the Verify tab to paste the expected signature and confirm whether it matches before you debug your own code.

A replay attack is when someone captures a validly signed request and re-sends it later to trigger the action again. Because HMAC is deterministic, the captured signature stays valid forever unless something in the signed data changes over time. The standard defense is to append a timestamp to the message before signing it, so the signature covers when the request was made. Your server then rejects any request whose timestamp falls outside a short window -- often a few minutes -- which makes a replayed signature stale and useless. This is exactly how providers like Stripe protect their webhooks. This tool can append a Unix epoch or ISO 8601 timestamp to your message before computing the HMAC, letting you reproduce a provider's signed string precisely or build your own replay-resistant signing scheme and test it against your verification logic.

A solid rule of thumb is to use a cryptographically random key of at least 256 bits, which is 32 bytes, and a key the same length as the hash output is a sound default -- 32 bytes for HMAC-SHA256, 64 bytes for HMAC-SHA512. Length matters less than randomness: a short, guessable, or human-chosen passphrase undermines HMAC no matter which algorithm you pair it with, because the whole security guarantee rests on the attacker not being able to find the key. Keys much longer than the hash's internal block size are hashed down first and give no extra strength. This tool includes one-click buttons to generate a random key of 16, 32, or 64 bytes using your browser's secure random number generator, so you can mint a properly sized secret without reaching for the command line, then sign with it immediately.