Security & Encoding
HMAC Generator
Sign a message with a secret key and get a ready-to-use HMAC signature. Pick the algorithm and output format, then copy the result. Everything is computed locally — your secret never leaves the page.
Message & key
privateSigned as UTF-8 bytes, exactly as typed — spaces and line breaks count.
Used as UTF-8 unless you change the key format. It is never sent anywhere.
Advanced options
Choose Hex or Base64 when your secret is already encoded, so the raw key bytes are used.
Signature
SHA-256How it works
HMAC signs a message with a shared secret so the receiver can confirm the message is authentic and unchanged. The message is converted to UTF-8 bytes and combined with the key using the chosen hash (SHA-256 by default; SHA-1 and MD5 are kept for compatibility with older systems). Hex is the most common output for API signatures; Base64 and URL-safe Base64 are available when a service expects them. Add the expected signature in the verify box to check a value from a server or a previous request. Everything runs in your browser — the message and secret are never uploaded.
Practical uses
Compute an HMAC signature for a message and key using a chosen hash algorithm.
Common ways to use it
- Reproduce a webhook signature to debug a rejected callback.
- Generate a keyed message digest for an API request in a test environment.
Things to keep in mind
- The same message and key always produce the same signature, so the key must still be kept secret.