# HMAC Generator

> Generate an HMAC signature with SHA-256, SHA-1, SHA-384 or SHA-512 and a secret key.

To generate an HMAC, enter your message and secret key and pick a hash algorithm. HMAC proves both integrity and authenticity because only someone holding the key can produce a matching signature — which is how webhook payloads from Stripe, GitHub and Slack are verified.

**URL:** https://convertto.tech/t/hmac-generator
**Category:** Hash & Crypto Tools (https://convertto.tech/c/crypto-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your message.
2. Enter or paste your secret key.
3. Choose the algorithm.
4. Choose the output.
5. The result appears immediately — copy or download it.

## FAQ

### What is HMAC used for?

Verifying that a message came from someone holding a shared secret and was not altered. Webhook providers sign each payload with HMAC so the receiver can confirm it is genuine.

### Is my secret key safe here?

The key is used only inside your browser via WebCrypto and is never sent anywhere. Even so, avoid pasting production secrets into any website as a matter of habit.

## Related tools

- [JWT Verifier](https://convertto.tech/t/jwt-verifier): Verify a JWT's HS256 signature and its expiry, issuer and audience claims, entirely in your browser.
- [Nano ID Generator](https://convertto.tech/t/nanoid-generator): Generate compact URL-safe unique IDs — shorter than a UUID with comparable collision safety.
- [Random String Generator](https://convertto.tech/t/random-string-generator): Generate random strings from a chosen character set — for keys, tokens and test data.
- [UUID v4 Generator](https://convertto.tech/t/uuid-v4-generator): Generate random RFC 4122 version 4 UUIDs in bulk.
- [UUID v7 Generator](https://convertto.tech/t/uuid-v7-generator): Generate time-sortable UUID version 7 identifiers — ideal as database primary keys.
- [JWT Signer](https://convertto.tech/t/jwt-signer): Create a signed HS256, HS384 or HS512 JSON Web Token for testing, entirely in your browser.
- [TOTP Code Generator](https://convertto.tech/t/totp-generator): Generate time-based one-time passwords from a Base32 secret to test 2FA setups.
- [cURL to Code Converter](https://convertto.tech/t/curl-to-code): Turn a cURL command into fetch, axios, Python requests or Node.js code.