HMAC Generator
Computes an HMAC with MD5, SHA-1, SHA-2, SHA-3 or RIPEMD-160 from a message and a shared key — for API request signing and verifying a message origin.
Computes a hash-based message authentication code (HMAC) using a secret key and your favorite hashing function.
Steps and notes
What is HMAC Generator — Sign Messages with SHA-256 Online?
HMAC (hash-based message authentication code) mixes a secret key into the hashing process, so the output can only be reproduced by someone who holds the same key. Where a plain hash proves "these bytes are unchanged", an HMAC proves "these bytes are unchanged AND sent by someone who knows the key" — which is why request signing for payment callbacks, webhooks and API authentication is built on it. The underlying algorithm matters less than key discipline: any member of the SHA-2 family is fine, but the key must travel to the other side over a channel you already trust, and must never appear in the request itself. This tool computes the HMAC locally in your browser, so it is safe for experimenting with real keys, but remember that anything pasted into a web page you do not control is a leak risk.
- Enter the message
- Enter the key
- Choose a hash algorithm to get the HMAC
- HMAC depends on the key: a different key gives a completely different result, so both sides must agree on it
Frequently asked questions
- HMAC vs a plain hash — when do I need the key?
- Whenever the receiver must know who produced the digest. A plain SHA-256 of a payload can be computed by anyone; an HMAC-SHA256 can only be computed (or verified) by holders of the key, which is what "signing" means in most API docs.
- Which HMAC algorithm should I pick?
- Match what the other side specifies — HMAC-SHA256 is the most common default. The algorithm is not a security dial: upgrading MD5 to SHA-512 does not compensate for a weak or reused key.
- Why does my HMAC not match the server's value?
- The usual suspects, in order: the key differs (trailing whitespace, a copied "example" key), the payload bytes differ (JSON key order, CRLF, unicode escaping), or you hashed the payload when the server signed payload plus extra headers. Compare hex outputs byte by byte.
Category: Crypto
Hashing & crypto workflow
Hash Generator — MD5, SHA-1, SHA-256 Online → HMAC Generator — Sign Messages with SHA-256 Online → Bcrypt → Encrypt / decrypt text → RSA Key Pair Generator → Password strength analyser → htpasswd generator and checker