HMAC Generator

HMAC (Hash-based Message Authentication Code) is a hash computed together with a secret key, proving a message hasn't changed and was sent by someone who knows that key. Unlike a plain hash, an HMAC can't be forged without knowing the secret.

How to use it

• Enter text or a file and a secret key — the HMAC is computed instantly with eight algorithms at once (MD5, SHA-1, SHA-2, SHA3, RIPEMD-160).
• Copy the variant you need to verify a signature or compare against an expected value.
• The same input and key always produce the same HMAC — handy for checking against a signature received from another system.

Common uses

• Verifying a webhook signature from a payment service or API (most sign the payload with HMAC-SHA256).
• Generating a request signature for an API that requires HMAC authentication.
• Debugging a mismatched signature — checking the key, input encoding, and algorithm one at a time.

Things to keep in mind

HMAC protects against tampering and confirms the sender's authenticity, but it doesn't encrypt the message itself — the content stays readable.

A mismatched HMAC is most often caused by different data encoding (e.g. JSON field order) or a stray whitespace or line break, not by a bug in the algorithm itself.