jsontools
Free · No signup · No tracking

HMAC Generator

Compute HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures with a secret key, instantly in your browser.

Message
13 bytes · or drop a .txt file
Secret key
SHA-1—
SHA-256—
SHA-384—
SHA-512—
No data sent to servers · computed via the native Web Crypto API

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a hash function with a secret key to produce a signature that proves both the integrity of a message and that it was signed by someone who knows the key.

Unlike a plain hash, HMAC cannot be reproduced without the secret — this is what makes it useful for verifying webhook payloads, signing API requests, and authenticating tokens.

SHA-1, SHA-256, SHA-384 and SHA-512

Four algorithms cover almost every real-world HMAC use case. HMAC-MD5 is not offered: the Web Crypto API does not implement it, and every common signing scheme (webhooks, AWS SigV4, JWT) already uses SHA.

HMAC-SHA1160-bit — legacy systems, still common in older webhook schemes
HMAC-SHA256256-bit — the de facto standard (Stripe, GitHub, AWS SigV4, JWT HS256)
HMAC-SHA384384-bit — used by JWT HS384
HMAC-SHA512512-bit — maximum collision resistance, used by JWT HS512

Client-side, no data sent

All signatures are computed directly in your browser using the native Web Crypto API (SubtleCrypto.sign). Neither your message nor your secret key ever leaves your machine — though as a general rule, avoid pasting production secrets into any web tool.