HMAC Generator
HMAC-SHA256/384/512 signing via Web Crypto.
HMAC Generator computes HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 message authentication codes directly in your browser using the Web Crypto API. Sign webhook payloads, verify API request signatures, and learn how keyed hashing works—without sending your secret key anywhere.
How it works
Your secret key is imported as a raw HMAC CryptoKey scoped to the chosen hash algorithm, then crypto.subtle.sign combines it with the UTF-8 encoded message. The resulting signature is formatted as hex or Base64 for comparison against signature headers.
Benefits
- HMAC-SHA256/384/512 via native Web Crypto, no libraries loaded
- Hex and Base64 digest output for different API conventions
- Secret key never leaves your browser tab
- Sensitive-tool defaults keep history off entirely
Use cases
- Verify inbound webhook signatures from payment or messaging providers
- Debug custom API request-signing implementations
- Teach how shared-secret message authentication works
- Regenerate a signature to compare against a provider's documentation example
Best practices
- Use the exact raw request body bytes as the message—reformatting breaks the signature
- Prefer HMAC-SHA256 or stronger; avoid legacy weak hash algorithms
- Rotate signing secrets periodically and after suspected exposure
- Never paste production signing secrets on shared or public computers
Common mistakes
- Signing a pretty-printed or re-serialized JSON body instead of the raw bytes received
- Mixing up hex and Base64 output formats when comparing signatures
- Assuming HMAC output is reversible—it is one-way, like other hash functions
- Reusing the same secret across unrelated systems, increasing blast radius on leak
Privacy
HMAC computation happens entirely in your browser via Web Crypto. Your secret key and message are not transmitted to ToolHub. Because this tool touches a secret key, on-device history is disabled entirely rather than opt-in.
Frequently asked questions
- What is HMAC used for?
- HMAC (Hash-based Message Authentication Code) proves that a message was created by someone who knows a shared secret key and was not altered in transit. It is widely used to sign webhooks, API requests, and tokens.
- Which hash algorithms are supported?
- This tool supports HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512, all computed with the browser's native Web Crypto API (crypto.subtle.importKey and crypto.subtle.sign).
- Is my secret key uploaded anywhere?
- No. The secret key and message stay in your browser's memory for the duration of the computation. Nothing is sent to ToolHub servers, and history is disabled by default for this tool.
- Why is history disabled for HMAC Generator?
- This tool touches a secret key, so it is marked sensitive and history storage is turned off entirely to avoid persisting secrets in LocalStorage on shared devices.
- How do I verify a webhook signature with this tool?
- Paste the exact raw request body as the message, enter the signing secret provided by the sender, choose the matching algorithm and output format, then compare the generated digest to the signature header.
- What output formats are available?
- You can copy the HMAC digest as lowercase hexadecimal or standard Base64, matching the format most APIs expect in their signature headers.
- Can I use this for password hashing?
- No. HMAC is designed for message authentication with a shared secret, not for password storage. Use a dedicated password hashing algorithm with salting and stretching for that purpose.
Related tools
Hash Generator
crypto
SHA-256/512 hashing for text and files via Web Crypto.
- hash
- sha256
- sha512
- checksum
JWT Decoder
security
Inspect JWT header and payload locally—no signature verify.
- jwt
- token
- decode
- security
AES Encrypt/Decrypt
crypto
Password-based AES-256-GCM demo via Web Crypto.
- aes
- encryption
- pbkdf2
- crypto
Password Generator
random
Secure local password generator with strength meter.
- password
- security
- random
- generator