FREE DEVELOPER TOOLS
Compute HMAC-SHA256, HMAC-SHA512, and other HMAC signatures using the Web Crypto API — entirely in your browser.
Output: 64 hex chars
Keep this secret. Anyone with this key can forge signatures. Use at least 32 random bytes for SHA-256.
HMAC (Hash-based Message Authentication Code) combines a secret key with a cryptographic hash function to produce a signature. It proves both that a message hasn't been tampered with (integrity) and that it came from someone who knows the secret key (authentication). The formula is:
HMAC(K, m) = H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ m))where H is the hash function, K is the key, and opad/ipad are fixed padding constants. In practice, you never implement this yourself — use your language's standard library or the Web Crypto API (as this tool does).
Stripe & PayPal webhooks
Payment providers sign webhook payloads with HMAC-SHA256. Your server recomputes the HMAC with your shared secret and compares it to the signature header — ensuring the payload came from the real provider.
AWS Signature v4
Every AWS API request is authenticated with a chain of HMAC-SHA256 operations. The signing key is derived from your secret access key, date, region, and service — making each signature unique and non-replayable.
JWT (HS256 / HS512)
JSON Web Tokens signed with HS256 use HMAC-SHA256. The header and payload are Base64url-encoded, then HMAC'd with your secret key. This is what our JWT Decoder tool reveals — though it cannot verify the signature without the key.
Cookie integrity
Frameworks like Express and Rails sign session cookies with HMAC to prevent tampering. A user who modifies their session cookie will produce an invalid HMAC, and the server will reject it.
Security tips