DeveloTools

HMAC Generator

Sign any message with a secret key using HMAC-SHA256, 384 or 512. Not the same as TokenSmith's JWT check — this signs plain text on its own.

100% client-side

Data

HMAC signature

—
Enter a message and a secret key.

What is an HMAC?

An HMAC (Hash-based Message Authentication Code) is a short code you attach to a message to prove two things at once: that the message hasn't been altered, and that whoever created it knows a shared secret key. It's the mechanism behind API request signing, webhook verification (Stripe, GitHub and similar services) and secure session tokens — different from a plain hash or a JWT, neither of which needs a shared secret to verify.

How to use HMAC Generator

  1. Choose an algorithm — HMAC-SHA256, SHA384 or SHA512 — from the Algorithm dropdown.
  2. Type or paste your text into the Message field.
  3. Enter the shared secret key in Secret key.
  4. Read the result under HMAC signature, switching between Hex and Base64 with the format toggle.
  5. Click Copy to copy the signature.

How HMAC signing works

HMAC (Hash-based Message Authentication Code, RFC 2104) combines a cryptographic hash function with a secret key so that only someone who knows the key can produce a valid signature for a given message:

message: "The quick brown fox jumps over the lazy dog"
secret:  "key"
HMAC-SHA256 = f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

A plain hash (SHA-256 alone) only proves a message wasn't altered — anyone can recompute it. HMAC additionally proves authenticity: the sender must have known the shared secret. It's also structurally resistant to length-extension attacks that affect naive uses of Merkle–Damgård hashes like SHA-256 on their own. This tool computes the signature with the browser's native crypto.subtle.importKey() / crypto.subtle.sign() (Web Cryptography API) — no external libraries, no server calls.

Frequently asked questions

Is my secret key sent to any server?

No. The signature is computed with the browser's native SubtleCrypto API; the message and secret never leave your machine.

How is HMAC different from a plain hash like SHA-256?

A plain hash proves data wasn't altered, but anyone can compute it. HMAC mixes in a secret key per RFC 2104, so only someone who knows the key can produce a valid signature — it proves both integrity and authenticity, and resists length-extension attacks that affect bare hashes.

Which algorithms are supported?

HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512, all computed with the Web Cryptography API's crypto.subtle.sign().

Is this the same as TokenSmith's JWT signature check?

No. TokenSmith verifies or generates a full JWT (header.payload.signature). This tool signs any arbitrary text with HMAC on its own — useful for webhook signatures, API request signing, or checking a vendor's HMAC example against your own implementation.

Related tools