HMAC Generator

Compute a keyed HMAC signature from a message and a secret, and check it against the one you were sent.

Runs on your deviceDeveloperWorkingNo account needed

What this tool does

An HMAC is a hash taken with a secret key folded into it, which lets it answer a question a plain digest cannot: not only whether the message is unchanged, but whether it came from someone holding the key. HMAC Generator takes the message from the input box and the key from the settings panel, then returns the signature as lowercase hex, padded Base64, or URL-safe Base64 without padding.

The SHA algorithms are computed by the browser's own Web Crypto implementation, which is available only in a secure context — over plain http the tool reports that instead of quietly falling back to something weaker. HMAC-MD5 is done in bundled JavaScript, because Web Crypto does not expose MD5 at all. The key can be supplied as UTF-8 text, hex bytes or Base64, and that choice matters more than it looks: a key printed as 40 hex characters is 20 bytes, so reading those same characters as text signs with 40 different bytes and produces a value that will never match the far end.

All of it happens in this browser tab. The secret and the message are not uploaded, which is the point of signing here rather than in someone else's form — a shared HMAC secret typed into a third-party page is a secret you now have to rotate. The key does sit in the settings field for as long as the tab is open, so clear it before you walk away from a machine that is not yours.

What the tool does not do is build the string you are signing. The message is read as UTF-8 exactly as typed, so every space, tab and line ending is part of what gets signed, and a single trailing newline changes the answer. Schemes such as AWS Signature Version 4 define their own canonical string and derive a chain of intermediate keys before the final step; you assemble that yourself and paste the result here. There is also no file input — this signs text, not bytes on disk.

How to use it

  1. Paste the message. The exact string being signed, line breaks included. Load sample shows the shape of a canonical request: method, path and timestamp on separate lines.
  2. Enter the secret key and say how it is encoded. UTF-8 text, hex bytes or Base64. Picking the wrong one is the usual reason two implementations disagree about the same message.
  3. Choose the algorithm and output format. HMAC-SHA-256 is the default, with SHA-1, SHA-384, SHA-512 and legacy MD5 alongside it. Output is hex, Base64 or URL-safe Base64.
  4. Compare with a signature, if you have one. Paste it into the optional field and the summary reads "Signature matches" or "Signature does NOT match". Hex is compared case-insensitively; Base64 has to match exactly.

Processing & privacy

Runs on your device. Your file is processed directly in this browser.

Common use cases

Verifying an incoming webhook

Recompute the signature over the raw body and timestamp the provider specifies, then check it against the value in their header.

Debugging a rejected API request

When a service answers with a signature mismatch, signing the same string by hand shows whether the fault is your code or your canonical string.

Working out how a key is meant to be read

Sign one message with the key as text and again as hex bytes. Whichever matches the other end tells you which encoding the documentation meant.

Building a test fixture

Produce a known-good signature for a fixed message and key, then assert against that constant in your test suite.

Questions

Is my secret key uploaded?
No. The key and the message stay in this browser tab and the signature is computed there, so there is no request carrying either of them. Clear the key field when you have finished on a machine other people use.
What is the difference between a hash and an HMAC?
A plain digest can be recomputed by anyone, so it shows only that data is unchanged. An HMAC mixes in a secret, so a matching value also shows the sender knew that secret. Use Hash Generator when no key is involved.
My signature does not match the server's — what is wrong?
Almost always the key encoding or the string being signed. Check whether the key is raw bytes written as hex rather than the characters themselves, then check the message for a trailing newline, CRLF line endings, or fields the other side orders differently.
Should I use HMAC-MD5 or HMAC-SHA-1?
Only where something you cannot change requires them. The collision attacks on MD5 and SHA-1 do not carry over directly into forging an HMAC, so existing deployments are not broken by them, but SHA-256 is the right default for anything new.
Which output encoding should I choose?
Whichever the other side expects — hex is the common default, and URL-safe Base64 shows up in tokens and query strings. The comparison field accepts all three regardless of what you picked, so a Base64 signature still gives a verdict while the output is set to hex.
Can I sign a file?
No. The input is a text box read as UTF-8, so this signs strings rather than stored bytes. For a file's fingerprint without a key, Hash Generator takes a file directly.
Is the comparison here safe to copy into my own code?
No, and it is not meant to be. This is a plain string comparison, which is fine for reading a verdict on your own screen. Verification code should use your language's constant-time compare, so the time taken does not reveal how much of the value was right.

Related tools