HMAC Generator
Create HMAC signatures for webhook payloads, API signing examples, and local verification workflows using browser-native crypto.
Last updated: May 28, 2026
Use test secrets or redacted keys. Do not paste production signing secrets into browser tools unless your security policy permits it.
Find this tool useful? Support the project to keep it free!
Buy me a coffeeWhat is HMAC Generator?
HMAC stands for Hash-based Message Authentication Code. It combines a message with a secret key and a hash function such as SHA-256. The resulting signature proves that the message was created by someone who knows the secret and that the message bytes have not changed.
How to Use HMAC Generator
Paste the message or payload to sign.
Paste the secret key and select text, hex, or Base64 format.
Choose SHA-256 unless your integration requires another algorithm.
Choose hex or Base64 output.
Click Generate HMAC and copy the signature.
Common Use Cases
- Generating local webhook signature examples.
- Debugging API request signing code.
- Comparing expected and actual HMAC-SHA256 values.
- Creating documentation fixtures for signed payloads.
- Testing whether a secret is interpreted as text, hex, or Base64 bytes.
Example Input and Output
A webhook-style JSON payload signed with a shared secret using HMAC-SHA256.
Message: {"event":"invoice.paid","id":"evt_12345","amount":4999}
Secret: webhook_signing_secret781def8a145865b85874db3b663e6317db4a2d8df0cad15877ed741e04059e94Signature comparison
When comparing signatures in application code, use a constant-time comparison to avoid timing leaks.
Secret handling
Prefer test secrets for online debugging. Production signing secrets should stay inside your controlled systems.