HMAC Generator
Generate HMAC signatures with SHA-1 through SHA-512
What is HMAC Generator?
This HMAC generator computes a keyed digest of your content using a shared secret and returns it in both hexadecimal and Base64, with SHA-1, SHA-256, SHA-384, and SHA-512 available. It is most often used to debug request signatures for open platform and payment APIs. Everything runs locally in the browser.
How to use HMAC Generator
- 1Paste the string-to-sign, assembled exactly as the platform specifies, into the left panel.
- 2Enter the shared secret.
- 3Pick the digest algorithm — most platforms use SHA-256.
- 4Take the hexadecimal or Base64 result, depending on what the API expects.
How do I do this in code?
Use the tool above for one-off work; for anything you repeat, move it into a script or your project.
# Hexadecimal echo -n "payload" | openssl dgst -sha256 -hmac "secret" # Base64 echo -n "payload" | openssl dgst -sha256 -hmac "secret" -binary | base64
Common errors and how to fix them
| Symptom | Cause | Fix |
|---|---|---|
| Your signature does not match the one the server computes | The string-to-sign is assembled differently on each side: parameter ordering, whether empty values are included, the separator, or whether values are URL-encoded. | Reproduce the concatenation exactly as the platform documentation describes, then print the actual string each side signs and diff them character by character. |
| Signatures diverge when parameters contain non-ASCII characters | The two sides use different character encodings, for example UTF-8 versus a legacy single-region encoding. | Encode the string as UTF-8 on both sides before computing the HMAC. |
Frequently asked questions
What is the difference between HMAC and a plain hash?+
Anyone can compute a plain hash, so it proves nothing about who produced the message. HMAC mixes in a shared secret, so only a party holding that key can produce a valid signature. That means HMAC verifies both that the content is intact and that the request came from a legitimate caller.
Is my secret key sent anywhere?+
No. The key is passed straight to the browser Web Crypto API and released with page memory afterwards. It is never written to localStorage and never included in a network request.
Related tools
All toolsBase64 Encoder & Decoder
Encode and decode Base64, with UTF-8 and URL-safe support
File to Base64
Convert files to Base64 and data URIs — nothing is uploaded
URL Encoder & Decoder
Percent-encode URLs, with separate modes for full URLs and parameter values
HTML Entity Encoder
Escape and unescape HTML entities
Hex to Text Converter
Convert between text and hex with several separator styles
Unicode Escape Converter
Escape and unescape Unicode in three notations