# HMAC Generator

> Generate keyed HMAC-SHA1, SHA-256, SHA-384 and SHA-512 signatures locally in your browser. For webhooks, APIs and signed messages.

Canonical: https://host-tools.com/tools/hmac-generator/

---

## What does this tool do?

HMAC (Hash-based Message Authentication Code) is a keyed hash: it turns a message into a
fixed-size signature using a secret key. Unlike a plain hash, the signature can only be
reproduced by someone who knows the secret, so it proves both integrity and authenticity.
This tool computes HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 and HMAC-SHA-512 locally in your
browser.

## When to use HMAC

- **Webhook signatures.** Providers such as GitHub and Stripe sign webhook payloads with
  HMAC so you can verify the request really came from them.
- **API authentication.** Signed request schemes use HMAC to authenticate without sending
  the secret itself.
- **Signed tokens and cookies.** HMAC produces tamper-evident values: any change to the
  message breaks the signature.

## How to verify a webhook signature

1. Paste the raw request body into *Message / payload*.
2. Paste the shared secret into *Secret key*.
3. Select the algorithm the provider documents (usually SHA-256).
4. Compare the result with the signature header. If they match, the payload is authentic.

## HMAC vs a plain hash

A plain hash (see [Hash Generator](/tools/hash-generator/)) proves nothing about who created
the value — anyone can hash. HMAC requires the secret key, so a valid signature is evidence
that the sender knows the secret.

## Which algorithm should I use?

- **SHA-256** is the modern default for webhooks and signed messages.
- **SHA-384** and **SHA-512** are stronger variants of the SHA-2 family.
- **SHA-1** is considered weak — keep it only for legacy integrations.

## Privacy

Everything runs locally in your browser. The secret key and the message are never uploaded.