Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512. Hex and Base64 output. Web Crypto API powered.
Client-side only
HMAC (Hash-based Message Authentication Code) provides data integrity and authentication. Common uses: API signatures (AWS, Stripe), webhook verification, JWT signing. Computed entirely in your browser via Web Crypto API.
This tool saved you time?
DevUtility Hub is free forever. If it helped you, consider buying us a coffee.
Copy to Clipboard — One-click copy for easy integration.
What is HMAC?
HMAC combines a cryptographic hash function with a secret key to produce a message authentication code. Unlike plain hashes (MD5, SHA-256), HMACs prove both data integrity AND authenticity — the message hasn't been tampered with, and it came from someone who knows the secret key.
Common Use Cases
API Authentication — AWS Signature V4, Stripe webhooks, GitHub webhooks all use HMAC-SHA-256.
JWT Signing — HS256 JWTs use HMAC-SHA-256 to sign tokens.
Webhook Verification — Validate that incoming webhooks are from the expected sender.
Data Integrity — Verify file or message integrity with a shared secret.