HMAC Generator
Compute HMAC-SHA-256/384/512 signatures of any message with a secret key — right in your browser via WebCrypto. Essential for webhook verification, API auth, and request signing.
Next steps
This tool runs entirely in your browser. Your data never leaves your device — it is not uploaded to any server.
How to use
- 1Enter the shared secret key — the same string the server or webhook provider gave you.
- 2Paste the raw message body (exact bytes: JSON, query string, timestamp+payload — whatever the API signs).
- 3Compare the produced hex or Base64 signature against the X-Signature header or verify it matches your own request.
HMAC Generator
HMAC (Hash-based Message Authentication Code) proves a message came from someone who holds the shared secret — without sending the secret itself. Stripe, GitHub, Slack and most webhook providers sign payloads this way; paste the signature header + your secret here to reproduce and verify it.
Pick SHA-256 for the modern default, SHA-512 for maximal margin, or SHA-1 only when a legacy API demands it. Both hex and Base64 outputs are shown — whichever encoding the service expects.
Frequently asked questions
What's the difference between HMAC and plain hashing?
Plain SHA-256(message) can be computed by anyone. HMAC(secret, message) requires the secret — only someone who holds it can reproduce the signature. That makes HMAC a proof of origin plus integrity, not just a checksum.
Why do webhooks use HMAC?
When Stripe or GitHub posts to your endpoint, they include an HMAC signature of the body. Recompute it with your webhook secret; if it matches, the request genuinely came from them — nobody else can forge it without the key.
Is my secret safe here?
Yes — all computation happens in your browser's WebCrypto engine. The secret and message never leave the device; nothing is logged or transmitted. Still, rotate secrets you paste into any website as a general habit.
HMAC-SHA-256 vs HMAC-SHA-512: which to pick?
SHA-256 is the universal default and what most APIs use. SHA-512 is stronger on paper and actually faster on 64-bit CPUs; use it when the spec gives you a choice. Avoid SHA-1 unless a legacy system mandates it.
Is the output safe to paste into production code?
Yes. Formatting, escaping and conversion follow the relevant specs (RFCs, W3C, JSON Schema), and nothing is sent anywhere — you can verify the output locally before committing it.
Does it work on large inputs?
Yes — everything runs locally. A multi-megabyte JSON file or a long regex session is limited only by your machine, not by a request size cap.
Related tools
SHA-256 Generator
Calculate SHA-256 hashes of text or files online using native WebCrypto — the standard choice for integrity checks and fingerprints. 100% client-side.
SHA-512 Generator
Compute SHA-512 hashes of text or files in your browser with native WebCrypto — the strongest SHA-2 digest for checksums, HMAC and archival integrity. 100% client-side.
JWT Decoder
Decode JWT tokens online: inspect the header and payload claims with human-readable exp and iat timestamps. Decoding only — nothing is verified or uploaded.
TOTP Generator
Generate 2FA codes offline from any TOTP secret — RFC 6238, 6 or 8 digits, live 30-second countdown. Your secret never leaves the browser.
MD5 Generator
Generate MD5 hashes of any text or file instantly in your browser — perfect for checksums, dedup keys and legacy integrations. One-way, never uploaded.
Base64 Image
Convert images to base64 data URLs and back — preview, validate and download, with an exact size comparison. Everything runs in your browser.
JSON Validator
Validate JSON instantly with precise error line and column. Catch missing commas, unquoted keys, trailing commas and bad escapes before they break your app.
JSON Formatter
Format and beautify messy JSON online — 2 spaces, 4 spaces or tabs, with instant validation and precise error locations. 100% in your browser.
URL Encoder
Percent-encode URLs and query strings online — choose component encoding or full URI encoding, with live output for links, parameters and path segments.
HTML Minifier
Minify HTML in your browser: strip comments and collapse whitespace to cut page weight — a conservative cleaner that keeps your markup and rendering intact.
Embed this tool
Put this tool on your own site with one line — it runs entirely in the visitor's browser.
<iframe src="https://zoyku.com/en/tools/hmac-generator?embed=1" width="100%" height="640" style="border:0;border-radius:16px" title="Zoyku — hmac-generator" loading="lazy"></iframe>