HMAC Signature Generator
Encoding & CryptoEverything runs locally in your browser — nothing is uploaded
Sign a message with a secret key using HMAC-SHA1, HMAC-SHA256 or HMAC-SHA512, and get the signature as hexadecimal or Base64. The key is processed as UTF-8 bytes, so keys containing spaces, accents or emoji produce exactly what Node, Java and Python produce — the most common reason a signature fails to match when you integrate with an API. A key is required: an empty key is arithmetically valid, but the signature it yields is unrelated to what you want and looks perfectly normal, so it is rejected here rather than sent off to fail somewhere with no explanation. Note also that HMAC is not the same as hashing key + message, which is vulnerable to length extension.
Features
- Three algorithms: HMAC-SHA1, HMAC-SHA256 and HMAC-SHA512
- A separate key field, so the key never gets pasted into a long message
- Key and message both processed as UTF-8 bytes, matching Node, Java and Python
- Output as hexadecimal or Base64
- Empty keys are rejected instead of producing a plausible-looking signature
- The key only ever takes part in local computation
How to use
- Enter the secret key in the key field
- Paste the message into the input box
- Choose the algorithm and output encoding, then press Ctrl/⌘ + Enter or click Run
- Click Copy to take the signature
FAQ
- How is HMAC different from hashing key + message?
- HMAC XORs the key into a padded block and hashes twice, inner and outer, and that structure makes it immune to length extension attacks. Plain hash(key + message) built on MD5, SHA-1 or SHA-256 lets an attacker compute further valid signatures without knowing the key. Never assemble that string by hand for an API.
- Why is a key mandatory?
- An empty key produces the signature of "the empty string as a key" — arithmetically valid, useless to you, and indistinguishable from a correct-looking signature. Sending it to an API only earns a verification failure with no clue attached. Rejecting it here saves that round trip.
- My signature does not match the other side. Why?
- Check three things in order: whether the key is treated as UTF-8 bytes (this tool does), whether the message carries stray spaces or newlines, and whether the output encoding matches (hex and Base64 are two views of the same bytes). The first two change the result completely.
- What does "this environment does not provide Web Crypto" mean?
- HMAC runs through the browser-native crypto.subtle API, which only exists in a secure context: https:// or localhost / 127.0.0.1. Opened over http:// or a LAN IP it is unavailable — that is a browser security policy. Use an https address, or another tool.
- Is my secret key uploaded?
- No. The key and the message take part only in computations inside your browser memory; the page makes no network requests and keeps working offline. That is also why verifying a signature is fine here — but do be careful about pasting production secrets on a shared machine.
Related tools
Hash
Encoding & CryptoCompute MD5, SHA-1, SHA-256 or SHA-512 digests of any text, hashed as UTF-8 bytes so they match openssl and sha256sum exactly. Runs in your browser.
Password Generator
GeneratorsGenerate strong random passwords with a live entropy readout, so strength becomes a number you can compare. Passwords stay in memory, never uploaded.
Base64
Encoding & CryptoConvert text to Base64 and back, with correct UTF-8 handling for accents, CJK and emoji. Runs entirely in your browser — nothing is uploaded.
URL Encode
Encoding & CryptoEscape text into %XX form and back again, treating a whole URL and a single parameter value as different jobs. Runs entirely in your browser.
HTML Entities
Encoding & CryptoTurn < > & and quotes into HTML entities and decode them back in a single pass, so &lt; becomes <, not an angle bracket. Runs in your browser.
JWT Decoder
Encoding & CryptoSplit a JWT into header, payload and signature, and read iat, nbf and exp as dates. The signature is not verified — decoding only, all in your browser.