Developer
Encoders, converters & dev utilities
HMAC Generator (HMAC-SHA256)
Generate an HMAC — a keyed hash that proves both the integrity and the authenticity of a message. HMAC (RFC 2104) combines a secret key with a hash function, so unlike a plain hash it cannot be recomputed by anyone who does not hold the key. It is what secures webhook signatures (Stripe, GitHub), API request signing, and the HS256 algorithm of JWTs. The construction is HMAC(key, msg) = H((key ⊕ opad) ‖ H((key ⊕ ipad) ‖ msg)). Worked example: HMAC-SHA256 with key "key" over "The quick brown fox jumps over the lazy dog" = f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. It runs 100% in your browser via Web Crypto — key and message never leave the page. Free, no login.
HMAC (RFC 2104) = a keyed hash: HMAC(key, msg) = H((key ⊕ opad) ‖ H((key ⊕ ipad) ‖ msg))
- Needs a SECRET KEY — that is what proves authenticity, not just integrity (a plain hash cannot)
- Byte-exact vector: HMAC-SHA256("key", "The quick brown fox jumps over the lazy dog") = f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
- Powers webhook signatures (Stripe/GitHub), API request signing, and the JWT HS256 algorithm
- In the browser: crypto.subtle.sign("HMAC", key, msg) — 100% client-side, key/message never uploaded
Frequently asked questions
How do I generate an HMAC?
Enter your message and a secret key and choose a hash (typically SHA-256); the tool computes HMAC(key, message) using the browser Web Crypto API and returns the hex digest. For example HMAC-SHA256 with the key "key" over "The quick brown fox jumps over the lazy dog" is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. Both the key and the message stay in your browser.
What is the difference between HMAC and a plain hash?
A plain hash like SHA-256 depends only on the message, so anyone can recompute it — it proves the data was not accidentally changed, but not who produced it. HMAC mixes in a secret key, so only parties who know the key can generate or verify the correct value. That extra property, authenticity, is why HMAC is used to sign webhooks and API requests: a receiver checks the HMAC to confirm the message really came from someone holding the shared secret and was not tampered with.
Where is HMAC used in practice?
Everywhere a shared secret authenticates a message. Stripe and GitHub sign their webhook payloads with HMAC-SHA256 so your server can verify the request is genuine. Cloud APIs use HMAC to sign requests (for example AWS Signature). And JWTs signed with HS256 are exactly an HMAC-SHA256 over the token's header and payload. In each case the receiver recomputes the HMAC with the secret key and compares it to the value supplied.