Santekno/tools

HMAC Generator

Generate or verify HMAC signatures (SHA-1/256/384/512). Secret never leaves your browser.

Processed in your browserUpdated · Jan 2026
Input
0 chars
Output
0 chars

How to use HMAC Generator

Paste your input on the left, choose the options you want, and the output appears instantly on the right. Everything runs in your browser — none of your data is sent to a server.

  • Paste or type your input in the INPUT panel
  • The output regenerates automatically as you type
  • Use Copy to put the result in your clipboard
  • Click Sample to load a working example

What is HMAC Generator?

HMAC Generator computes RFC 2104 keyed hash message authentication codes using SHA-1, SHA-256 (default), SHA-384, or SHA-512. Pick hex or base64 output, or switch to Verify mode to constant-time compare against an expected signature (accepts hex or base64). Common uses: webhook signature verification (Stripe, GitHub, Slack, Twilio), JWT HS256/HS384/HS512 signing helpers, S3 / AWS SigV4 derivations, and any HMAC-based MAC. The secret is held only in React component state — never written to localStorage, sessionStorage, IndexedDB, or cookies. Closing the tab forgets it. This tool is part of santekno's developer toolbox — a curated collection of utilities built for engineers who care about speed, privacy, and simplicity.

Common use cases

  • Debugging API payloads and integration issues
  • Inspecting tokens, hashes, or encoded strings during development
  • Generating fixtures and sample data for tests
  • Sharing readable output with teammates in code reviews

FAQ

HMAC uses a secret key plus the message. Plain SHA-256 hashes only the message — anyone can recompute it. HMAC proves both the sender knows the key AND the message wasn't altered. Use it for webhook verification, API request signing, and MACs.

SHA-256 is the default and what most APIs (Stripe, GitHub, Slack) expect. SHA-512 is fine and slightly stronger. SHA-1 is provided only for legacy compatibility — avoid for new designs.

Verify uses constant-time comparison, which is immune to timing side-channels. Plain `==` returns early on the first mismatched byte and leaks information about how many bytes matched — enabling forgery attacks over the network.

No. It lives only in volatile component state — refresh the page or close the tab and it is gone. Nothing is written to localStorage, sessionStorage, IndexedDB, or cookies.

You can compute the signing input HMAC manually (header.payload base64url-encoded) and base64url-encode the result. For an end-to-end JWT workflow use a dedicated JWT signer; this tool is for the raw HMAC primitive.