About this online tool
hidevtool HMAC generator computes a message authentication code from UTF-8 text and a secret key. Choose MD5, SHA-1, or SHA-2 family algorithms and hex or Base64 output—nothing is uploaded.
Online HMAC generator capabilities
What is the secret key for?
The secret is mixed into the hash together with your message. Only parties that know the same key can reproduce the same MAC. That proves the message was not tampered with and likely came from someone who holds the key—unlike plain SHA, where anyone can recompute the digest.
Hash algorithms
- HMAC-SHA256 — most common for APIs and webhooks today.
- HMAC-SHA512 / SHA-384 — longer MACs when your spec requires them.
- HMAC-SHA1 — legacy integrations; avoid for new security designs.
- HMAC-MD5 — compatibility only; not for new secrets or payments.
Message & key
- Both message and secret are UTF-8 strings, same as typical SDK examples.
- Sender and receiver must use the same algorithm, key, and encoding (hex vs Base64).
- The message is not hidden—HMAC signs integrity, it does not encrypt.
Output encoding
- Hex — lowercase, easy to paste into logs and JSON fields.
- Base64 — shorter on the wire; match what your API documentation specifies.
Security tips
- 1Use long random secrets; never embed production keys in public front-end code.
- 2Prefer HMAC-SHA256 or stronger for new APIs; rotate keys when staff or vendors change.
- 3Compare MACs in constant time in your server code to reduce timing attacks.
- 4Do not reuse the same secret across unrelated products or environments.
- 5For password storage, use PBKDF2/bcrypt/Argon2—not HMAC alone.
Common use cases
API request signing
Sign canonical request strings or body hashes the way your gateway or payment provider documents.
Webhooks
Verify X-Hub-Signature or similar headers by recomputing HMAC with your endpoint secret.
JWT HS* debugging
Cross-check HMAC-SHA256 signatures while integrating with services that use symmetric JWT keys.
Frequently asked questions
- What is HMAC used for?
- API signatures, webhook verification, and any case where two sides share a secret and need to detect tampering.
- Why do I need a secret key?
- Without a secret, a hash only shows content changed—not who produced it. The key lets verifiers accept MACs only from holders of that secret.
- Which algorithm should I pick?
- Default to HMAC-SHA256 unless your documentation names SHA-512, SHA-1, or MD5 for legacy compatibility. The MAC updates automatically when message, secret, algorithm, or encoding changes.
- Hex or Base64 output?
- Follow your API spec. This tool supports both; hex is common in docs, Base64 in some HTTP headers.
- Is my secret uploaded?
- No. HMAC runs entirely in your browser.