Developer tools
HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 locally in your browser.
Text is encoded as UTF-8. The signature is generated locally in your browser.
Create an HMAC signature without sending your secret anywhere.
Enter a secret key and message, choose SHA-1, SHA-256, SHA-384, or SHA-512, then copy the signature as hexadecimal, Base64, or unpadded Base64URL. The key and message are encoded as UTF-8 and processed locally in your browser. This tool creates signatures; use the same secret, algorithm, message encoding, and output encoding in the system that verifies them.
Frequently Asked Questions
Everything you need to know about this tool, how it works, and privacy.
What is an HMAC?
An HMAC is a message authentication code made from a secret key, a message, and a hash function. A receiver that has the same secret can generate the expected signature and compare it with the one it received.
Which algorithms and encodings does this HMAC generator support?
Choose SHA-1, SHA-256, SHA-384, or SHA-512. The tool encodes the key and message as UTF-8, then returns the signature as hexadecimal, Base64, or unpadded Base64URL. Use matching settings wherever you verify the signature.
Can this output verify a webhook or another signature?
It creates a signature for the text and secret you enter. Verification must happen in the receiving application with the same secret, algorithm, exact message bytes, and encoding; this tool does not validate a remote service or replace its verification procedure.
Do my key and message leave my browser?
No. The HMAC operation and copy action run locally in your browser. CodeASystem does not upload or store the key, message, or generated signature.