Toolgeist › Security

HMAC Generator — Compute a Keyed Hash for Message Authentication

Enter a message and a secret key to compute an HMAC — a hash-based message authentication code that proves both that a message was not tampered with and that it came from someone who knows the secret key, which a plain hash cannot do on its own. Common for signing webhook payloads and API requests.

How to use HMAC Generator

1. Enter the message and your secret key.
2. Choose the algorithm (SHA-256 is standard).
3. Read the generated HMAC.
4. Compare it against the HMAC you received to verify authenticity.

Frequently asked questions

How is HMAC different from a plain hash?

A plain hash only proves the message was not altered; HMAC also proves the sender knew the secret key, because the key is mixed into the computation — a plain hash of the message alone cannot verify sender authenticity.

What is HMAC commonly used for?

Verifying webhook payloads (Stripe, GitHub and similar services sign webhooks this way), signing API requests, and JWT signature verification when using an HMAC-based algorithm like HS256.

Is my secret key uploaded anywhere?

No. The HMAC computation runs entirely in your browser using the Web Crypto API.

Related Security tools

• Vigenère Cipher
• Caesar Cipher
• TOTP Generator
• IPv6 Validator
• Env Generator
• ROT13 Cipher

Also searched for: hmac sha256 generator · verify webhook signature hmac · hmac calculator online

Browse all 738 free tools on Toolgeist →