HMAC Generator

Generate HMAC signatures (HMAC-SHA-256, SHA-384, SHA-512) locally in browser using Web Crypto API.

How to Use HMAC Generator

Specify your security requirements (password length, character types, or hashing algorithm) in hmac generator.
Adjust parameters such as uppercase letters, numbers, symbols, or salt keys.
Click Generate to produce cryptographically strong keys or hashes client-side.
Copy the generated credentials or hash digests safely to your clipboard.

Related Security & Privacy Tools

File SHA-256 Checksum Verifier
Verify file integrity and detect modifications by calculating SHA-256 checksum hashes locally.
File Checksum & Hash Verifier
Calculate SHA-256, SHA-1, and MD5 file integrity hashes locally to verify authentic downloads.
Password Strength Checker
Test password entropy, length, and security strength rating.
Password Entropy Calculator
Measure password cryptographic entropy score (bits), character pool size, and strength rating locally in your browser.
Secret Token Generator
Generate cryptographically secure API keys, secret tokens, and random hex/base64url strings using Web Crypto PRNG.

Frequently Asked Questions

What is an HMAC and how does it differ from a standard hash?

An HMAC (Hash-based Message Authentication Code, RFC 2104) is a cryptographic signature calculated by combining a secret key with a message payload through a hashing algorithm. Unlike a simple hash, an HMAC verifies both data integrity (the message was not changed) and data authenticity (only holders of the secret key could have generated it).

Which HMAC hashing algorithms and output encodings are supported?

The generator supports HMAC-SHA-256 (the industry standard for modern webhooks), HMAC-SHA-384, and HMAC-SHA-512. Signatures can be formatted as lowercase Hexadecimal strings or standard Base64 encoding.

How does this tool handle secret keys securely?

Secret keys are imported directly into the Web Crypto API sandbox using crypto.subtle.importKey. Signing occurs in hardware-accelerated browser memory. Neither your secret key nor your message payload is ever transmitted over the network or logged.

How do webhook providers like GitHub, Stripe, and Shopify use HMAC signatures?

When a webhook event occurs, the provider signs the JSON payload using your shared secret key and attaches the HMAC signature in an HTTP header (e.g., Stripe-Signature or X-Hub-Signature-256). Your receiving server computes the HMAC of the raw body and compares it to verify authenticity.

What should I do if my calculated HMAC does not match a webhook signature?

Ensure you are signing the exact raw request body string before JSON parsing, including whitespace and line breaks. Check whether the provider expects Hexadecimal or Base64 encoding, and verify that no signature prefixes (like 'sha256=') are included in the hash comparison.