HMAC Generator
Generate an HMAC signature for a message using a secret key.
Last updated August 26, 2026
About this tool
An HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature that proves both the integrity of a message and that it was created by someone who knows the secret — the basis for signing webhook payloads, API requests, and JWTs. This tool computes HMAC-SHA256, HMAC-SHA1, or HMAC-SHA512 signatures using the Web Crypto API.
Code examples
The second line (where shown) is the inverse operation.
| Language | Code |
|---|---|
| Node.js | crypto.createHmac('sha256', secret).update(message).digest('hex') |
| Python | hmac.new(secret.encode(), message.encode(), hashlib.sha256).hexdigest() |
| PHP | hash_hmac('sha256', $message, $secret) |
Frequently asked questions
How is HMAC different from a plain hash like SHA-256?
A plain hash has no secret — anyone can compute it, so it only proves data hasn't changed. HMAC mixes in a secret key, so a valid signature also proves the message came from someone who holds that secret, which is essential for verifying webhooks and signed API requests.
Is my secret key sent anywhere?
No — the HMAC is computed entirely in your browser using the Web Crypto API; nothing is transmitted to a server.