HMAC Generator
Generate or verify HMAC-SHA1 through HMAC-SHA512 in this tab. Hex or Base64. The secret stays on this device.
How it works
Enter the message and secret
Paste the payload and the shared key. Encoding is UTF-8. Copy sits on each field label.
Pick algorithm and encoding
HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. Hex is lowercase. Generate writes standard Base64. Verify with Base64 also accepts Base64URL (- and _).
Generate or verify
Generate shows the MAC as you type. Verify: pick Hex or Base64, paste only the received HMAC, and read match or mismatch. A webhook is genuine only if the secret is the same one the sender used.
What is HMAC?
HMAC (Hash-based Message Authentication Code) mixes a shared secret with a hash such as SHA-256. Webhooks and APIs use it so the receiver can tell that the body was not altered. This tool computes HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 in the tab, as hex or Base64, and can check a received MAC without showing the computed value. Easy24 does not receive the message or the secret.
Why use this tool
- HMAC Generator runs in a browser tab.
- Generate and verify HMAC-SHA1 through HMAC-SHA512
- Hex or Base64, live as you type
- No account. Unlimited on the free plan
Questions
What is HMAC?
HMAC is a keyed hash (RFC 2104). It proves a message was not changed and that the sender knew the secret. It is not encryption. This page runs in your browser.
How do I use HMAC Generator?
Paste the message and secret, pick an algorithm and Hex or Base64. Generate shows the MAC as you type. Copy sits on each field label.
How do I verify an HMAC?
Open Verify. Pick Hex or Base64 to match the value you received, then paste only that HMAC. The page reports a match or a mismatch. It does not show the computed MAC.
HMAC-SHA256 or SHA-256?
SHA-256 hashes only the message. HMAC-SHA256 hashes the message with a secret. Use HMAC when you need to authenticate, not just checksum.
Hex or Base64?
Same bytes, different text. APIs often want hex. Some want Base64. Generate writes standard Base64. Verify with Base64 also accepts Base64URL.
Is HMAC encryption?
No. Anyone who sees the message can read it. HMAC only detects tampering when the verifier has the same secret.
Is SHA-1 safe?
SHA-1 is deprecated. Use HMAC-SHA256 unless you must match an older system.
Does it hash files?
No. This page signs UTF-8 text. For a file digest without a key, use File Hash.
Is my secret sent to a server?
No. Signing and verifying run in this tab. Easy24 does not receive the message or the secret.
Is there a daily limit?
No. There is no daily cap on this tool.
Do I need an account?
No. Open the page and use it.
Does it work on a phone?
Yes. It runs in the mobile browser.
If Easy24 helped, buy a coffee
Tools stay free in your browser. One-time thanks via Kreosus. Turkish cards work.
Similar Security tools
See allHash Generator
Security
MD5, SHA-1, SHA-256, SHA-384, or SHA-512 of UTF-8 text. Hex or Base64. Compare a known digest.
OpenHTTP Basic Auth
Security
Build or parse an Authorization: Basic header from a username and password.
OpenCaesar Cipher
Security
Shift Latin letters by a chosen amount. ROT13 is shift 13.
Open