HMAC Generator
Generate HMAC signatures for API authentication and webhook verification. Nothing ever leaves your browser.
Enter a message and secret key to generate the HMAC signature
Your secret key and message never leave your browser. All computation uses the Web Crypto API.
HMAC SHA-256 FAQ
What is HMAC-SHA256?
HMAC-SHA256 combines the SHA-256 hash function with a secret key to produce a 256-bit (32-byte) message authentication code. It is defined in RFC 2104 and widely used for API authentication.
How is HMAC different from a hash?
A hash is a one-way function that produces a fixed-size output from any input. HMAC adds a secret key, so only parties who know the key can generate or verify the signature. This prevents tampering.
Where is HMAC-SHA256 used?
It is the standard for webhook signatures (Stripe, GitHub, Slack), JWT signing (HS256), AWS Signature V4, OAuth 1.0, and many REST API authentication schemes.
Is HMAC-SHA256 secure?
Yes. HMAC-SHA256 is considered very secure for message authentication. It is recommended by NIST, used in TLS, and has no known practical attacks.
Need to share API keys or webhook secrets?
Don't paste credentials into chat or email. Use CredenShare to deliver them with AES-256 encryption and automatic expiration.