Frequently Asked Questions
How do I generate an HMAC?
Enter your message and your secret key, choose the algorithm (HMAC-SHA256 is standard), and pick an output format — hex, Base64, or binary. The HMAC appears instantly. To verify a received signature, paste it into the expected-HMAC field and the tool reports whether it matches. Everything happens in your browser; your message and key are never uploaded.
Does this upload my message or key, and does it work offline?
No upload, and yes it works offline. Both the message and the secret key are processed in your browser using the Web Crypto API — there's no server involved, no logging, and no tracking. That's important because a leaked key breaks HMAC entirely. Once the page has loaded it keeps working with no internet connection, so your key stays on your device.
What is an HMAC, and how is it different from a plain hash?
A plain hash fingerprints a message with no secret. An HMAC hashes the message together with a secret key, so only someone holding that key can produce (or verify) the correct code. That extra ingredient turns a fingerprint into proof of authenticity — evidence the message came from a key-holder and wasn't altered — which a plain hash alone can't provide, since anyone can hash anything.
What does the secret key do?
The key is what makes an HMAC trustworthy. Because the code depends on both the message and the key, an attacker who changes the message can't recompute a valid HMAC without the key. Both sender and receiver share the same secret; the sender attaches the HMAC, and the receiver recomputes it with their copy of the key to confirm the message is genuine and unmodified.
Which algorithm should I use?
Use HMAC-SHA256 unless a system you're integrating with requires something else. It's the modern standard, widely supported, and secure. SHA-384 and SHA-512 offer longer digests if you need them. Only reach for HMAC-SHA1 or HMAC-MD5 to match a legacy system that mandates them — while HMAC hardens those older hashes considerably, they're not the choice for new designs.
Is HMAC encryption?
No. HMAC is authentication, not encryption — a common confusion. It proves a message is authentic and unchanged, but it does not hide the message: the content remains fully readable to anyone who sees it. If you need to keep the message secret, you must encrypt it separately. Think of HMAC as a tamper-evident seal, not a locked box.
Is HMAC-MD5 or HMAC-SHA1 safe?
They're stronger than the bare hashes, because the HMAC construction is resistant to the collision attacks that break plain MD5 and SHA-1. That means an existing system using HMAC-MD5 or HMAC-SHA1 isn't immediately broken. But they're legacy: for any new design, use HMAC-SHA256 or better. Only select MD5 or SHA-1 here to interoperate with something that already requires them.
How do I verify a webhook or API signature?
Take the raw payload as the message and your webhook's signing secret as the key, then compute the HMAC using the exact algorithm and encoding the provider specifies (often HMAC-SHA256 in hex or Base64). Paste the signature from the request header into the expected-HMAC field. A match confirms the request is genuine and untampered; a mismatch means you should reject it.
What output formats are supported?
Hex (lowercase and uppercase), Base64, and binary. Which one you need depends on the system you're matching: many APIs send signatures as lowercase hex, others as Base64. Pick the format the provider uses so your computed value can be compared directly — a format mismatch is a frequent reason a correct HMAC appears not to match, even when the underlying bytes are identical.
What does an HMAC actually protect against?
Tampering and impersonation. Because a valid HMAC requires the secret key, an attacker can't alter the message and produce a matching code, and can't forge a message that appears to come from a legitimate key-holder. It gives you integrity (the message wasn't changed) and authenticity (it came from someone with the key). It does not provide confidentiality — that requires encryption.
Where should I keep the secret key?
Somewhere secret and out of your codebase — an environment variable, a secrets manager, or a secure vault — never hard-coded in client-side code or committed to Git. Since anyone with the key can forge valid HMACs, its secrecy is the entire security of the scheme. Rotate it if you suspect exposure. This tool never stores or transmits the key; it only uses it locally to compute the code.
Is it free, and are there limits?
Yes, completely free — no payment, no signup, no account, and no usage caps or watermarks. Since everything runs in your browser, there's nothing for us to meter; the only practical limit is your device's performance on very long messages. Use it as much as you like, including offline once the page has loaded.
Still have questions?
If you can't find the answer you're looking for, feel free to contact our support team.