HMAC generator (SHA-256, SHA-512)
Calculate the HMAC signature of a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512, with hex or Base64 output, and validate webhooks.
How to useCalculate a message's HMAC
Available in: 
HMAC generator (SHA-256, SHA-512): what it is for
Type the message and the secret key (as text, hex or Base64) and choose the algorithm. The tool calculates the HMAC with the Web Crypto API and shows the result in hex, Base64 and Base64 URL. Paste the signature received in a webhook to see instantly whether it matches.
The message and key are not sent to any server: the calculation happens in your browser.
How to use
- Paste the message and the key.
- Choose the algorithm.
- Copy the HMAC or compare it with the received signature.
When to use it
- Validating payment and API webhooks.
- Signing integration requests.
- Debugging signature errors.
Frequently asked questions
What is HMAC?
It is an authentication code that combines a hash function with a secret key. Anyone with the same key can recalculate the HMAC and confirm the message was not altered and came from someone who knows the secret.
What is it used for in practice?
To validate webhooks from services such as payment gateways and messaging platforms, sign API requests and generate tokens. Paste the request body and the secret and compare with the signature you received.
Is the key sent anywhere?
No. The calculation is done in your browser with the Web Crypto API, and nothing leaves your device.
Is it really free?
Yes, 100% free. No sign-up, no subscription and no usage limits. All Tools123 tools are free and run right in your browser.