HMAC generator

Client

Compute a keyed hash (HMAC) over a UTF-8 message with a UTF-8 shared secret. Pick SHA-256, SHA-384, SHA-512, or legacy SHA-1; read the digest as lowercase hex or Base64.

When to use this vs the general crypto page

The crypto workspace covers ciphers and simple digests. This page is only for HMAC so you can iterate on signing parameters without switching tabs. For file bytes, use file checksum ; for opaque tokens, use JWT decode to inspect structure first.

Key and message

?

Uses the Web Crypto API in this browser. The shared secret and message are never sent to Toolcore. Align charset and line endings with the system you are debugging.

Output

HMAC

—

Common use cases

  • Match an HMAC signature from API documentation (AWS, Stripe-style webhooks, custom providers) before changing server code.
  • Compare hex versus Base64 encodings of the same MAC when one system logs bytes differently.
  • Verify that newline and JSON spacing match the string that the server actually signs.

Common mistakes to avoid

  • Assuming every service uses raw UTF-8 for the key

    Some systems use Base64-decoded keys or fixed-width binary. If results differ, check the provider’s encoding steps.

  • Forgetting line ending differences

    \n versus \r\n changes the MAC. Normalize in your editor or match the producer exactly.

  • Using SHA-1 for new designs

    SHA-1 HMAC is listed for legacy integrations. Prefer SHA-256 or stronger for new APIs.

FAQ

Is the secret uploaded to Toolcore?

No. HMAC runs in your browser via the Web Crypto API. Do not use production secrets on shared machines.

Why does my result differ from the server?

Usually key encoding, message bytes, or hash algorithm. Confirm the same HMAC hash name, exact key bytes, and the exact string or body the server signs.

Can this verify a JWT signature?

JWT verification needs the full token format and often asymmetric keys. Use the dedicated JWT decode page for structure, then compare HMAC here only for shared-secret algorithms you control end-to-end.

Common search terms

Phrases people search for that match this tool. See the full long-tail keyword index.

  • hmac sha256 online
  • hmac generator browser
  • compute hmac for webhook
  • hmac sha256 hex string

More tools

Related utilities you can open in another tab—mostly client-side.