HMAC Generator
Generate an HMAC (hash-based message authentication code) from a message and secret key using MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 or RIPEMD-160, in hex or base64, and optionally verify it against an expected HMAC.
Input
The key is interpreted as UTF-8 text.
Hex comparison is case-insensitive; base64 is case-sensitive.
Output
Only shown when an expected HMAC is provided.
Guides
Generate an HMAC (hash-based message authentication code) from any message and a secret key, right in your browser. Pick a hash algorithm, choose hex or base64 output, and — if you have one — paste an expected value to verify it in a single step.
What is an HMAC?
An HMAC is a keyed cryptographic checksum. Unlike a plain hash (which anyone can recompute from the message alone), an HMAC also mixes in a secret key, so only parties who know that key can produce or verify the code. It is defined by RFC 2104 and is the standard way to prove that a message is both authentic (it came from someone holding the key) and intact (it was not altered in transit).
HMACs are everywhere: signing API requests (AWS Signature, webhooks from Stripe, GitHub and Slack), the integrity layer inside TLS, JWT HS256/HS512 tokens, and password-based key derivation (PBKDF2 is built on HMAC).
How to use this tool
- Enter the message you want to authenticate.
- Enter the secret key — it is treated as UTF-8 text.
- Choose a hash algorithm (SHA-256 is the sensible default).
- Pick the output format: lowercase hex, uppercase hex, or base64.
- Read the computed HMAC from the output box. Copy or download it as needed.
To check a value you already have, paste it into Expected HMAC and the tool reports "Match" or "No match". Hex comparison is case-insensitive; base64 is case-sensitive.
Everything runs locally in your browser — your message and secret key are never sent to a server.
Which algorithm should I pick?
Match whatever the system you are integrating with expects. HMAC-SHA256 is the modern default and the right choice unless told otherwise. SHA-384 and SHA-512 give longer codes; SHA3-256 and SHA3-512 use the newer Keccak-based family.
MD5, SHA-1 and RIPEMD-160 are offered only for interoperability with older systems. While HMAC remains relatively robust even over a weak hash, you should not choose these for anything new.
FAQ
Is an HMAC the same as a hash?
No. A hash takes only a message; an HMAC takes a message and a secret key. Two people with the same message get the same hash, but only someone who also knows the key can reproduce the HMAC.
Why does my result differ from another tool?
The most common cause is key encoding. This tool treats the key as UTF-8 text. Tools that read the key as hex or base64 bytes will produce a different result for the same visible characters. Line endings in the message (\n vs \r\n) and trailing whitespace also change the output.
Can I use this to verify a webhook signature?
Yes. Set the algorithm to match the provider (usually SHA-256), enter the signing secret as the key and the raw request body as the message, then compare the result against the signature header using the Expected HMAC field.
Is it secure to paste my secret key here?
The computation happens entirely in your browser and nothing is transmitted. Shareable links for this tool never include the message or the key. Still, avoid pasting production secrets into any web tool on a machine you do not control.
Use it from code
From 3 credits per callREST API
curl -X POST https://api.iotools.cloud/v1/tool/hmac-generator \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"inputText": "The quick brown fox jumps over the lazy dog",
"secret": "key",
"algorithm": "sha256",
"outputFormat": "hex",
"expectedHmac": ""
}'Swap in your own key from your account. The tool's fields are the body — no wrapper.
Ask an AI agent
Use the IOTools `hmac-generator` tool (HMAC Generator) on this input:
YOUR_INPUT_HEREPaste this at any agent connected to the IOTools MCP server, then add your input.