Developer Tools
Generate an HMAC
Hmac Generator for generating checksum or signature-style values from text.
Direct Answer
Use the HMAC Generator when you need a keyed hash of a message using a shared secret, such as verifying a webhook signature, signing an API request, or checking that a message hasn't been altered by someone who doesn't know the key.
How HMAC differs from a plain hash
A plain hash like SHA-256 alone has no secret involved, so anyone can compute the hash of a known message and get a matching result. HMAC combines a secret key with the message through a specific nested-hashing construction, so only someone who holds the correct key can produce or verify a matching digest, which is what makes it suitable for authentication rather than plain fingerprinting.
- Requires a secret key that both the sender and the verifier already share
- Commonly found in webhook signature headers from providers like payment and version-control platforms
- Also used for signing REST API requests where the server checks the signature against its copy of the key
- Can be built on top of different underlying hash functions, most commonly SHA-256 today
- Produces a fixed-length digest, typically shown as hex or base64
Common HMAC uses
HMAC shows up anywhere two parties need to trust that a message came from someone who holds a shared secret and wasn't altered in transit.
- Verifying that a webhook payload actually came from the expected provider
- Signing API requests so a server can confirm the caller holds a valid secret
- Generating short-lived signed tokens between trusted internal services
- Confirming message integrity between two systems that already share a key
- Authenticating log entries or event records within a controlled system
Specific Use Cases This Tool Handles
Common situations where this tool helps, and what to do in each.
| Use Case | How This Page Helps |
|---|---|
| Copy-ready variations | Generate several options, copy the best result, then regenerate when you need another batch. |
| Fast naming and content drafts | Use generated output as a starting point for captions, titles, names, snippets, or random values. |
| No account workflow | Run the generator in the browser without signing into a large creative suite. |
How to Use Hmac Generator
- Set your options (length, type, count) using the controls.
- Click Generate to produce new results.
- Click Copy next to any item to copy it individually, or Copy all to get everything.
- Download .txt saves all generated results as a text file.
- Click Generate again for a fresh set.
Reference
| Feature | Details |
|---|---|
| Purpose | Generate reusable output from selected options. |
| Input | Settings such as count, length, format, or topic. |
| Result | Generated items ready to copy. |
| Best for | Fast ideas, random values, names, passwords, codes, and reusable snippets. |
| Category | Developer Tools |
| Works on | Desktop, tablet, and mobile browsers |
Useful Related Tools
Frequently Asked Questions
What is the actual difference between a hash and an HMAC?
A plain hash has no secret involved, so anyone can compute the hash of a known message and get the exact same result. HMAC mixes a secret key into the computation, so only someone holding that key can produce or verify a digest that matches, which is the basis for authenticating messages rather than just fingerprinting them.
Why does this tool ask me to enter a secret key?
HMAC's algorithm combines the key with the message through a specific nested hashing construction, so the key is a required input, not optional metadata. Without the exact same key used on the other end, you cannot reproduce a matching digest.
Which underlying hash function should I choose for HMAC?
HMAC-SHA256 is the modern default and is what most current APIs and webhook providers use. HMAC-SHA1 and HMAC-MD5 still appear in older systems for backward compatibility, but new integrations should use HMAC-SHA256 or stronger unless a specific legacy system requires otherwise.
Can someone forge a valid HMAC without knowing the secret key?
For HMAC-SHA256 with a strong, random secret, forging a matching digest without the key is not practically feasible. That resistance to forgery without the key is the entire point of using HMAC instead of a plain hash for authentication.
How do I verify a webhook signature using this tool?
Take the exact raw request body, compute an HMAC of it using the shared secret and the hash algorithm the provider specifies, and compare the resulting digest to the value in the signature header. The two must match exactly, including format, for the payload to be considered authentic.
Why doesn't my computed HMAC match the one from the server?
The most common causes are using the wrong secret key, choosing a different hash algorithm than the server used, or hashing a reformatted version of the payload instead of the exact raw bytes the server signed, such as after whitespace changes or key reordering during JSON re-serialization.
Does the length of my secret key matter?
Yes. Longer, random secrets are meaningfully stronger than short or predictable ones. Keys shorter than the underlying hash function's block size get padded internally, while longer keys get hashed down first, but a weak or guessable key undermines HMAC's security regardless of its length.
Is HMAC the same as encrypting a message?
No. HMAC does not hide the content of the message at all; it only proves to someone holding the shared key that the message is authentic and unaltered. If the message content itself needs to stay confidential, that requires separate encryption.