What is HMAC used for?

HMAC combines a secret key with a message to produce a signature that proves the message came from someone who knows the key and was not altered in transit. It is widely used to sign API requests and verify webhook payloads.

Which algorithm should I use?

Use whichever algorithm the service you are integrating with expects, since HMAC signatures only match if both sides use the same one. SHA-256 is the most common default when you have a free choice.

Why do I get different results in hex and Base64?

Both represent the exact same signature bytes, just encoded differently. Pick whichever format the system you are working with expects.

Is my secret key sent anywhere or stored?

The secret and message are sent to our API only to compute the signature and are not logged or saved. If you are working with a real production secret, treat this the same as any other tool you paste secrets into.

DAILYTOOLER

HMAC generator

Generate an HMAC signature from a secret key and a message, in MD5, SHA-1, SHA-256, SHA-384 or SHA-512, shown as hex or Base64.

Algorithm

Output format

Secret key

Message

What is an HMAC generator?

Enter a secret key and a message to get an HMAC signature in MD5, SHA-1, SHA-256, SHA-384 or SHA-512, shown as hex or Base64, useful for testing webhook signatures or signed API requests.

HMAC generator

What is an HMAC generator?

Frequently asked questions