How is HMAC different from a plain hash?
Plain hashes are public; HMAC requires a secret key, so you can verify the message came from a trusted party and was not tampered with.
HMAC Generator
DevTools HMAC Generator computes keyed message authentication codes locally in your browser—for webhook signature debugging, API signing, and integrity checks.
HMAC Generator
Generate HMAC digests with a secret key—useful for webhook signatures and API auth debugging.
About this tool
HMAC combines a hash with a secret key—only key holders produce matching signatures. Common in payment notifications, platform callbacks, and private APIs.
How to use
- Enter the message content.
- Enter the shared secret key.
- Select the HMAC algorithm and generate the signature.
FAQ
Why does verification fail?
Common causes: body reformatting, different newlines, encoding mismatch, or comparing hex to Base64.
Is my secret key uploaded?
No. HMAC is computed locally in your browser.
Which algorithms are supported?
Common options include HMAC-SHA256 and related SHA variants available in the tool UI.
Related tools
- Converters
Convert between common formats: CSV/JSON, YAML/JSON, TOML/JSON, Markdown/HTML, timestamps, image Base64, text encodings, and number bases.
- Formatter
Format and beautify SQL, HTML, XML, and YAML, plus a regex debugger—all run locally in the browser, free with no sign-up.
- JSON Tools
Full JSON toolkit: format, validate, minify, convert to CSV/XML, diff, generate and validate Schema, JSONPath, and tree view—all processed locally in the browser.
- Favicon Generator
Upload a logo, preview browser and Google search results, configure iOS/Android icons, and generate a complete favicon package in one click.