Cryptography

HMAC Generator & Verifier

Generate and verify HMAC-SHA signatures in hexadecimal or Base64.

Generate and verify HMAC signatures

Enter the exact message bytes represented by your text, a shared secret, the expected SHA-2 variant, and the signature encoding. Generate produces a signature; Verify recalculates it with the same inputs and compares the decoded bytes. A different newline, character encoding, secret, algorithm, or output encoding changes the result.

Loading tool...

Common webhook and API uses

  • Reproduce a webhook signature while debugging an integration.
  • Compare a locally calculated HMAC with a signature from a trusted sender.
  • Convert the same HMAC bytes between hexadecimal and Base64 representations.
  • Confirm that message changes cause signature verification to fail.

Security boundary

HMAC requires a strong shared secret delivered and stored securely. This browser tool is useful for test data, but production secrets should remain in controlled application environments. HMAC authenticates data; it does not encrypt it and it is not a password-storage scheme. Signature checking is delegated to the browser Web Crypto API instead of comparing signature bytes in application JavaScript.

Related developer tools

Continue with PKCE Generator & Verifier, SHA256 Hash, MD5 Hash.

PKCE Generator & Verifier

Generate and verify OAuth PKCE S256 verifier and challenge pairs

SHA256 Hash

Generate SHA256 hashes

MD5 Hash

Generate MD5 hashes

How to Use HMAC Generator & Verifier

  1. Enter or paste your input in the text area above
  2. The tool will process your input automatically or click the action button
  3. Copy the result using the copy button

Frequently Asked Questions

What is HMAC?

HMAC is a keyed message authentication code that combines a cryptographic hash function with a shared secret to check message integrity and authenticity.

Is HMAC encryption?

No. HMAC does not hide the message. It lets parties that share a secret detect changes and authenticate the message source.

Which algorithms and output formats are supported?

The tool supports HMAC with SHA-256, SHA-384, or SHA-512 and displays or verifies signatures in hexadecimal or standard Base64.

Sources & references

Primary references: RFC 2104: HMAC - Keyed-Hashing for Message Authentication; RFC 4231: HMAC-SHA-2 Identifiers and Test Vectors; W3C Web Cryptography API: HMAC.

Last reviewed: