HMAC Online — Generate & Verify Signatures with All SHA Algorithms
HMAC-SHA1 · HMAC-SHA256 · HMAC-SHA384 · HMAC-SHA512 · Webhook verify · Batch · API signing · 100% browser-side
🔒 Key never leaves your browser — processed via Web Crypto API
Enter message + secret key to generate HMAC
HMAC-SHA256 · HMAC-SHA512 · Real-time · Web Crypto API
The complete online HMAC toolkit — generate HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 simultaneously. Verify signatures, batch process multiple messages, and get code examples for Node.js, Python, PHP, and cURL. All browser-side.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a cryptographic technique that combines a hash function with a secret key. Unlike a plain hash which only verifies data integrity, HMAC also proves authenticity — only someone with the correct secret key can produce a valid HMAC. It is the backbone of API authentication, webhook verification, and JWT signatures.
HMAC-SHA256 vs HMAC-SHA512
HMAC-SHA256 is the current industry standard — used by AWS Signature V4, GitHub webhooks, Stripe, Shopify, and most modern REST APIs. It produces a 64-character hex signature. HMAC-SHA512 provides extra security with a 128-character hex signature and is preferred for banking, fintech, and high-security systems. Both are secure — choose SHA256 for compatibility and SHA512 for maximum security.
Frequently Asked Questions
What HMAC algorithms does this tool support?
HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512. All are computed simultaneously from a single message and secret key.
How do I verify an HMAC signature?
Enter the same message and secret key, then paste the signature you received in the Verify Mode. The tool instantly shows ✅ Match or ❌ No match.
Does this work offline?
Yes. All HMAC computation uses the Web Crypto API which runs entirely in your browser. No internet connection needed after the page loads.
How do I batch process multiple messages?
Click Batch Mode, ensure your secret key is entered above, then paste one message per line. All messages are signed with your chosen algorithm simultaneously.