Generate HMAC-SHA256 and HMAC-SHA512 signatures from a secret key and message online for free. Runs via Web Crypto in your browser. No signup required.
First time here? Enter your secret key Your input is processed locally and disappears when you close the tab.
Debugging a webhook that fails signature verification is miserable without a reference implementation. Our free HMAC Generator is that reference: enter the secret key and the exact payload, pick HMAC-SHA256 or HMAC-SHA512, and get the signature in both hex and Base64 — computed locally with the Web Crypto API.
HMACs are the authenticity backbone of the modern web: Stripe, GitHub, Slack, and Shopify sign webhook payloads with them; AWS-style request signing builds on them; JWTs with HS256/HS512 are HMACs at heart. When your computed signature doesn't match the provider's, this tool lets you isolate whether the bug is in your key handling, payload serialization, or encoding choice.
Because signing happens in your browser, pasting a real secret here is categorically different from pasting it into a server-backed site — the key and message never leave your machine. Inspect the tokens you're signing with our JWT Decoder, or generate plain digests with the SHA-256 and SHA-512 generators.
Enter your secret key
Paste the message or payload to sign
Choose HMAC-SHA256 or HMAC-SHA512
Copy the signature as hex or Base64
Compare against the signature you're verifying
Sign a file instead
Drag & drop or click — the file never leaves your device