Whether you're signing API requests, verifying webhook payloads, or learning how message authentication works, this tool gives you a fast, accurate HMAC without installing any library.
From secret key to verified signature in four straightforward steps.
Understanding how HMAC works helps you pick the right algorithm and avoid common signing mistakes.
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to verify both the integrity and authenticity of a message. Unlike a plain hash, an HMAC can only be reproduced by someone who holds the secret key — making it the standard choice for signing API requests, verifying webhook payloads, and protecting tokens like JWTs from tampering.
SHA-256 is the most widely used and recommended default — it's fast, well-supported, and considered secure for virtually all applications, including AWS Signature V4 and most webhook providers. SHA-512 and SHA-384 offer a larger output and are used where longer keys or higher theoretical security margins are required. SHA-1 is included for compatibility with legacy systems only — avoid it for new integrations since SHA-1 the underlying hash function is considered cryptographically weak (note this weakness applies to plain SHA-1 hashing; HMAC-SHA1 itself remains structurally sound but is being phased out in most modern specs).
Hex is the most common HMAC output format and is used by most REST APIs and documentation examples. Base64 is more compact and is often required by cloud provider SDKs (e.g. AWS, Azure). Base64url replaces the +, /, and padding characters with URL-safe equivalents, making it the correct choice for signed URLs and JWT signatures, which must not contain characters that need URL-encoding.
Quick guide to which algorithm and encoding fit each use case.
| Option | Output | Where it's Used |
|---|---|---|
| HMAC-SHA256 Recommended | 64 hex chars / 256 bits | Default for most APIs, AWS Signature V4, GitHub & Stripe webhooks |
| HMAC-SHA512 | 128 hex chars / 512 bits | Higher-margin signing, some enterprise and government systems |
| HMAC-SHA384 | 96 hex chars / 384 bits | TLS cipher suites, some enterprise authentication protocols |
| HMAC-SHA1 Legacy | 40 hex chars / 160 bits | Older OAuth 1.0a and legacy webhook integrations only |
| Hex | Lowercase 0–9, a–f | Most REST API documentation and signature headers |
| Base64 | Standard Base64 alphabet | Cloud SDKs (AWS, Azure), compact header values |
| Base64url URL-Safe | URL-safe Base64 alphabet | Signed URLs, JWT signatures, query-string tokens |
Signing and verifying messages is a routine part of building secure systems — this tool covers the most common scenarios instantly.
Answers to the most common questions about generating HMAC signatures with this tool.
Yes — completely free. There are no limits, no accounts, no watermarks, and no charges. Generate as many HMAC signatures as you need.
SHA-256, SHA-512, SHA-384, and SHA-1 are supported via the browser's built-in SubtleCrypto API, so results match standard HMAC implementations exactly.
No — never. All HMAC computation uses the Web Crypto API locally in your browser. Your secret key and message never leave your device.
You can output the signature as Hex, Base64, or Base64url — the three formats most commonly required by APIs, webhooks, and signed URLs.
Generate a signature with the same key, message, algorithm, and encoding as the original, then paste the expected HMAC into the Verify Signature panel. The tool uses a constant-time comparison to confirm a match.
HMAC verifies both the integrity and authenticity of a message — commonly used for API request signing, webhook payload verification, and JWT signatures.
Tried the tool? Leave a quick rating and help others find it.
All tools at I7 Pixel run in your browser — no uploads, no accounts, always free.