What this tool does
HMAC (Hash-based Message Authentication Code) is a "keyed hash": the message and a secret key go into a hash function together, producing a fixed-length signature. Only someone holding the same key can reproduce it — which makes it the standard way to verify that a message was not tampered with and came from someone who knows the key.
Typical uses: verifying webhook signatures (GitHub, payment callbacks and Slack all use HMAC), debugging API authentication, or confirming a download came from a trusted channel. This page uses the browser-native Web Crypto — your key and message are never uploaded.
How to use
- Enter message and key The message is the content being signed; the key is the shared secret. Both participate as UTF-8 bytes.
- Pick algorithm and output format SHA-256 is the common default (64 hex chars); switch to SHA-384/512 when the other side requires it. Choose hex or Base64 output to match the peer's documentation.
- Compare with the peer Compare this result with the received signature: a match means the message is trustworthy. Mind casing and peer conventions like prepended timestamps.
FAQ
HMAC vs a plain hash like SHA-256?
Anyone can compute a plain hash; HMAC adds a secret key — without it, signatures cannot be forged. Use HMAC to verify origin and integrity, plain hashes to check for corruption.
Is the signature deterministic?
Yes. Same message + same key + same algorithm always yields the same signature — unlike randomized asymmetric signatures.
Why does my signature mismatch the server?
Common causes: stray newline or spaces in the key, the peer prepends a timestamp/path, casing differs, or algorithm/encoding mismatch. Check the peer's docs step by step.
Is HMAC-MD5 or SHA1 supported?
No. MD5/SHA1 are no longer suitable for security; use SHA-256 or above. If a peer still requires them, that is a signal to push for an upgrade.
Is my key safe? Is it logged?
Everything is computed in this page's browser; the key and message never leave your device and are not stored anywhere.
Can I HMAC a large file?
This tool targets text messages (≤512KB). Streaming HMAC over large files is a separate use case — watch the hash tool for future support.
Limits
Three algorithms only (SHA-256/384/512), output as lowercase hex or Base64.
Messages up to 512KB; the key is treated as UTF-8 text — binary keys are not accepted.
Signature comparison requires both sides to agree on algorithm, encoding and concatenation order — this tool does not guess peer rules.