HMAC Generator Online – Free SHA-256, SHA-512 Tool | ThinkForU

Free Online HMAC Generator – SHA-256, SHA-512, SHA-384, SHA-1

Enter your message and secret key, pick an algorithm, and get your HMAC signature instantly.

🔒 Zero Data Storage: All HMAC generation uses the browser's built-in Web Crypto API. Your message and secret key never leave your device. Read our Zero Data Storage Policy →

Algorithm & Output Format

SHA-256 256-bit output Recommended SHA-384 384-bit output SHA-512 512-bit output SHA-1 160-bit, legacy

Output: # Hexadecimal B64 Base64 🔗 Base64url

Message Input

0 characters 0 lines

Secret Key

0 characters Keep this secret — never share your HMAC key

HMAC Signature READY

0 characters —

—

Algorithm

—

Format

—

Output Bits

—

Length (chars)

Signature Details

Algorithm

—

Key Length

—

Message Length

—

Output Format

—

Argon2 Hash Generator Base64 Encoder Base64 Decoder XML to JSON ROT13 Cipher Leetspeak Generator Text Reverser Word Counter

About

What is HMAC?

HMAC (Hash-based Message Authentication Code) is a cryptographic technique that combines a secret key with a message and a hash function to produce a unique fixed-length signature. It proves both the integrity (the message wasn't altered) and authenticity (the sender knows the secret key) of the data.

HMAC is standardised in RFC 2104 and is used in HTTPS, JWTs, API authentication, webhook verification, OAuth, and more. Unlike plain hashing (SHA-256 alone), HMAC cannot be replicated without knowing the secret key — making it significantly more secure for authentication purposes.

Algorithm Comparison

Algorithm	Output Size	Security Level	Best Use Case
HMAC-SHA-256	256 bits / 64 hex chars	✅ Strong — Recommended	General purpose, APIs, JWTs, webhooks
HMAC-SHA-384	384 bits / 96 hex chars	✅ Very Strong	High-security applications, compliance
HMAC-SHA-512	512 bits / 128 hex chars	✅ Maximum	Highest security needs, long-term storage
HMAC-SHA-1	160 bits / 40 hex chars	⚠️ Legacy only	Legacy systems, GitHub webhooks (old format)

Guide

How to Use This HMAC Generator

✍️

1. Enter Message

Type or paste the message or data payload you want to authenticate.

🔑

2. Enter Secret Key

Provide your secret key. This must match exactly on both sender and receiver sides. Use the eye icon to toggle visibility.

🎚️

3. Choose Algorithm

Select SHA-256 (recommended), SHA-384, SHA-512, or SHA-1 for legacy systems.

📐

4. Choose Format

Pick Hex, Base64, or Base64url output format depending on your system's requirements.

⚡

5. Generate

Click "Generate HMAC" or enable Live Mode for instant real-time generation as you type.

📋

6. Copy & Use

Copy the HMAC signature and use it in your API header, webhook, or JWT.

Use Cases

Who Uses HMAC?

🔌

API Authentication

Sign API requests with HMAC so servers can verify the request came from a legitimate client with the correct key.

🪝

Webhook Verification

GitHub, Stripe, Shopify, and most platforms send HMAC signatures with webhooks so you can verify the payload isn't forged.

🎫

JWT Tokens

HMAC-SHA256 is the most common algorithm for signing JSON Web Tokens (HS256 in JWT spec).

🔐

Data Integrity

Verify that files or messages haven't been tampered with during transmission — any change invalidates the HMAC.

🎓

Learning & Testing

Test and verify HMAC implementations in your codebase, compare outputs across languages and libraries.

💻

Developers

Quickly generate test HMAC values during development without writing code. Ctrl+Enter to generate instantly.

FAQ

Frequently Asked Questions

Is my message and secret key sent to any server?

No. All HMAC generation uses the browser's built-in window.crypto.subtle Web Crypto API — a native, sandboxed cryptography engine built into every modern browser. Your message and secret key never leave your device. See our Zero Data Storage Policy.

What is the difference between HMAC and a plain hash (SHA-256)?

A plain hash like SHA-256 takes only a message as input. Anyone can compute it — it proves nothing about who created it. HMAC combines the message with a secret key, so only parties who know the key can produce or verify the correct HMAC. This makes HMAC suitable for authentication, while plain hashing is only suitable for integrity checks without authentication.

Which algorithm should I use?

HMAC-SHA-256 is the best choice for most applications — it's fast, secure, and universally supported. Use SHA-384 or SHA-512 if you need extra security margin for long-term data or compliance requirements. Avoid SHA-1 for new systems — it's only included for compatibility with legacy systems like older GitHub webhook integrations.

When should I use Hex vs Base64 vs Base64url output?

Hex is the most human-readable — use it when comparing values manually or for debugging. Base64 is 33% more compact than hex — use it for HTTP headers and email. Base64url replaces +// with -/_ and strips padding — use it for JWTs, URL parameters, and anywhere the standard Base64 characters would need escaping.

How do I verify a webhook HMAC signature?

When you receive a webhook from a provider (e.g. Stripe, GitHub), paste the webhook body as the Message and your webhook secret as the Key. Select the algorithm the provider uses (usually SHA-256) and Hex or Base64 as specified in their docs. If your generated HMAC matches the signature in the webhook header — the payload is authentic.

What is Live Mode?

Live Mode automatically regenerates the HMAC whenever you type in either the message or key fields — no need to click Generate each time. Useful when iterating on a message format or testing key values. Toggle it on with the Live button, or use Ctrl+Enter / Cmd+Enter to generate manually.

Can the same message produce different HMACs?

Yes — with a different secret key, the same message produces a completely different HMAC. Even a single character change in either the message or key produces a completely different output. This is by design: it ensures HMAC signatures are unique per sender.

Is there a message length limit?

No hard limit — HMAC can process messages of any size. The output length is always fixed regardless of message length (e.g. HMAC-SHA-256 always produces 256 bits). Very large inputs may take a moment on slower devices.