Delimiter.live
Encoding & Security Tools Runs in your browser Free · no account

Online HMAC Generator

The HMAC generator computes a keyed message authentication code from your message and secret using SHA-1, SHA-256, SHA-384 or SHA-512. HMAC proves both that a message is unchanged and that it came from someone holding the key.

Options
Message 0 characters
HMAC signature

Your result will appear here.

Not sure where to start? Use Load example.

Results update automatically and are calculated on your device. Nothing you type is sent to a server.

Runs in your browser. Processing happens entirely in your browser. Nothing you enter is sent to Delimiter.live.

How to use the HMAC Generator

  1. Paste the exact message body you need to sign — byte-for-byte, including whitespace.
  2. Enter the shared secret.
  3. Choose the hash algorithm your integration specifies, usually SHA-256.
  4. Copy the signature in the format the receiving system expects.

Example

Input
Message: hello
Secret: key
Output
9307b3b915efb5171ff14d8cb55fbcc798c6c0ef1456d66ded1a6aa723a58b7b

Common use cases

  • Reproducing a webhook signature to work out why verification is failing.
  • Generating a signature for an API that requires request signing.
  • Checking that your own implementation produces the same value as a reference.

Limitations and things to watch for

  • Computation happens in your browser and nothing is transmitted. Even so, treat this as a debugging tool: prefer a test key, and rotate any production secret you have pasted into a browser tab on a shared machine.
  • HMAC is exquisitely sensitive to the exact bytes signed. A trailing newline, different line endings or re-serialised JSON produces a completely different signature — that is almost always why webhook verification fails.
  • When comparing signatures in your own code, use a constant-time comparison to avoid timing attacks.

Frequently asked questions

What is the difference between a hash and an HMAC?
A hash proves data has not changed. An HMAC additionally proves it came from someone who holds the secret key, because the key is mixed into the computation. Webhook signing uses HMAC for exactly this reason.
Why does my signature not match the provider's?
Nearly always because the signed bytes differ. Sign the raw request body exactly as received — do not parse and re-serialise the JSON, and watch for trailing newlines and CRLF line endings.
Is my secret key sent anywhere?
No. The HMAC is computed with the browser Web Crypto API and neither the key nor the message is transmitted.
Which algorithm should I choose?
SHA-256 unless the integration specifies otherwise. HMAC-SHA1 remains cryptographically sound despite SHA-1 collision weaknesses, but new systems should use SHA-256.

Share this tool