HMAC Generator Online — SHA-256/512, API Signing

Sign a message with a secret key using HMAC-SHA. Choose hex or unpadded base64url output. It runs locally. It is not a password hash and not a base for production authentication.

Loading…
HMAC generator for API signatures
Compute HMAC-SHA digests from a message and secret. Hex, base64, or unpadded base64url. Not a password hash.

How HMAC works here

Enter a message and a secret key. Choose SHA-256, SHA-384, or SHA-512. The digest updates automatically through Web Crypto. Paste an expected digest to check for a match. HMAC authenticates a message with a shared secret. It is not meant for storing passwords, so use bcrypt for password hashing.

Options

Algorithm
HMAC-SHA-256 (the default), SHA-384, or SHA-512, which is the set Web Crypto supports natively.
Output
Use hex for headers and checksums, unpadded base64url for compact tokens, and standard padded base64 for APIs that expect it.
Uppercase hex
Applies only when output is hex. Ignored for base64 and base64url.
Key encoding
How the secret is decoded before HMAC: UTF-8 text (default), hex bytes, or base64 / base64url bytes.
Verify digest
Paste an expected digest. Comparison ignores hex case and spaces, and base64url padding.

Examples

Classic vector

Message

POST /v1/orders HTTP/1.1 host: api.example.test content-type: application/json x-request-id: fm-demo-hmac-signing-fixture-001 {"id":42,"total":19.99,"currency":"USD","items":[{"sku":"FM-001","qty":2}]} # Fixture body for FastMinify HMAC generator sample (not a real request)

HMAC-SHA-256 (hex)

600cc1f2dd302d203d9a41acdcfd2a2a195e6f5a34da12b55af6d1c27e6d9941

API body

Message

{"id":42}

HMAC-SHA-256 (hex)

Digest with your shared secret (SHA-256 hex by default)

Related tools

For checksums without a secret use hash-generator. For password storage use bcrypt-hash.

HMAC FAQ

Signing digests

Is HMAC a password hash?

No. HMAC signs a message with a shared secret. For password storage use bcrypt-hash.

Is base64url padded?

No. This tool emits unpadded base64url, with no trailing =. Use the base64 output option when the API expects standard padded base64.

My API key is hex or base64, not UTF-8 text. What then?

Set Key encoding to hex or base64, so the secret is decoded to bytes before HMAC. UTF-8 would sign the characters, not the key bytes.

How do I check a digest from my backend?

Paste it in Expected digest. A match means the same message, key bytes, algorithm, and output format.

Does my secret leave the browser?

No. All HMAC computation runs locally via Web Crypto.

Encoding

Encode or decode Base64, URLs, HTML entities and JWTs, and generate hashes and HMACs in your browser.

Explore other tool categories