Does the signature update as I type, or do I need to click a button?

It updates on its own, about 120ms after you stop typing in either the message or the secret field. There's no compute button; the short delay just avoids recalculating four signatures on every keystroke.

What does switching between Hex and Base64 actually change?

Nothing about the signature itself, only how its raw bytes are displayed. Hex is longer but easy to compare character by character; Base64 is shorter and is what most APIs, Stripe and GitHub webhook headers among them, put in the header you're checking against.

Why do all four signatures stay blank until I fill in both fields?

An HMAC needs both a message and a secret to mean anything. With either one empty, the tool leaves all four results blank rather than computing a signature against an empty string, which would look valid but wouldn't match anything a real client sends.

HMAC Generator: HMAC-SHA256 & SHA-512 Online

Messagepaste or type · or drop a .txt file

Browse 13 bytes

Secret key

SHA-1—

SHA-256—

SHA-384—

SHA-512—

No data sent to servers · computed via the native Web Crypto API

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature that proves both the integrity of a message and that it was signed by someone who knows the key.

Unlike a plain hash, HMAC cannot be reproduced without the secret — this is what makes it useful for verifying webhook payloads, signing API requests, and authenticating tokens.

SHA-1, SHA-256, SHA-384 and SHA-512

Four algorithms cover almost every real-world HMAC use case. HMAC-MD5 is not offered: the Web Crypto API does not implement it, and every common signing scheme (webhooks, AWS SigV4, JWT) already uses SHA.

HMAC-SHA1160-bit — legacy systems, still common in older webhook schemes

HMAC-SHA256256-bit — the de facto standard (Stripe, GitHub, AWS SigV4, JWT HS256)

HMAC-SHA384384-bit — used by JWT HS384

HMAC-SHA512512-bit — maximum collision resistance, used by JWT HS512

Client-side, no data sent

All signatures are computed directly in your browser using the native Web Crypto API (SubtleCrypto.sign). Neither your message nor your secret key ever leaves your machine — though as a general rule, avoid pasting production secrets into any web tool.

Frequently asked questions

Web Crypto's subtle.sign only accepts a SHA-family algorithm as the underlying hash for HMAC, there's no MD5 option to pass it. The Hash Generator works around that same kind of gap for plain hashing with its own hand-rolled MD5, but repeating that here wasn't worth it: none of the schemes HMAC actually gets used for, webhook signatures, AWS SigV4, JWT HS256, ever specify MD5.