Overview
Introduction
Plenty of APIs and webhook providers authenticate a payload by sending it alongside an HMAC signature computed with a shared secret, and verifying it means recomputing the same HMAC yourself.
This tool computes that HMAC for a message and key, using MD5, SHA-1, SHA-256, SHA-384, or SHA-512 as the underlying hash, entirely in your browser.
What Is HMAC Generator?
An RFC 2104 HMAC calculator: given a message, a secret key, and a choice of underlying hash algorithm, it outputs the resulting authentication tag as lowercase hex.
HMAC's inner/outer double-hashing construction is what makes it resistant to length-extension attacks that a naive key‖message hash would be vulnerable to.
How HMAC Generator Works
The key and message are both UTF-8-encoded, then passed to @noble/hashes' `hmac()` function along with the chosen underlying hash function (MD5, SHA-1, or one of the SHA-2 family), which implements the RFC 2104 construction: hash(key XOR opad || hash(key XOR ipad || message)).
The resulting digest bytes are formatted as lowercase hex.
When To Use HMAC Generator
Use it to verify a webhook payload's signature by recomputing the HMAC with the shared secret and comparing it to the signature header the sender included.
It's also useful for generating a signature to send from your own code during development or debugging, before wiring up the real HMAC call in your application.
Often used alongside Hash Generator, SHA-256 Hash Calculator and JWT Debugger & Signature Verifier.
Features
Advantages
- Supports the five most commonly used underlying hash algorithms in one tool.
- Uses a well-audited implementation (@noble/hashes) rather than a hand-rolled HMAC construction.
- Computes entirely client-side, so a secret key you're testing with never leaves your browser.
Limitations
- Only computes HMACs over UTF-8 text input; it doesn't accept raw binary or file input.
- Doesn't verify a signature against an expected value for you; you'll need to compare the output yourself (or paste both into a diff tool).
Examples
Best Practices & Notes
Best Practices
- Use a long, randomly generated secret key rather than a short or guessable one; HMAC's security depends entirely on the key remaining secret.
- Compare signatures using a constant-time comparison in your actual application code, not a simple string `===`, to avoid timing side-channel leaks (this browser tool is for generating/checking values by eye, not for that comparison itself).
- Prefer HMAC-SHA256 or stronger for any new integration; only use HMAC-MD5 or HMAC-SHA1 to match an existing legacy system's requirement.
Developer Notes
Uses `@noble/hashes/hmac.js`'s `hmac(hash, key, message)` function, passing one of `@noble/hashes/legacy.js`'s `md5`/`sha1` or `@noble/hashes/sha2.js`'s `sha256`/`sha384`/`sha512` as the underlying hash; the resulting digest bytes are hex-encoded with this category's shared `toHex()` helper.
HMAC Generator Use Cases
- Verifying a webhook payload's HMAC signature by recomputing it with the shared secret
- Generating a test signature during development before wiring up the real signing code
- Understanding how a specific HMAC-based API authentication scheme actually computes its signature
Common Mistakes
- Hashing key‖message together instead of using a real HMAC construction; that approach is vulnerable to length-extension attacks that HMAC's double-hashing specifically prevents.
- Using the wrong underlying algorithm; many webhook providers document exactly which one (often SHA-256) their signature header expects.
Tips
- If a webhook's signature header includes a prefix like "sha256=", strip it before comparing against this tool's raw hex output.