How to Generate an HMAC Signature
Published September 13, 2026 · 2 min read
HMACs are used to verify both the integrity and authenticity of a message — proving it came from someone who knows the secret key and wasn't altered in transit. This computes an HMAC over text or a file using your chosen algorithm and key.
Try HMAC GeneratorSteps
- 1
Open the HMAC Generator tool
Go to the HMAC generator.
- 2
Enter text, or select a file
Provide the message to sign — typed text or an exact file's bytes.
- 3
Enter your secret key
Type the shared secret key used for the signature.
- 4
Choose an algorithm and encoding
Pick SHA-256, SHA-384 or SHA-512, and hex, base64 or base64url output.
- 5
Copy the signature
Use it to sign a webhook payload, API request, or verify one you received.
Frequently asked questions
A plain hash only proves data integrity (nothing changed); an HMAC additionally proves authenticity, since only someone with the secret key could have generated a matching signature.
Yes — select a file instead of typing text to sign its exact bytes, useful for verifying downloaded files or webhook payloads.
No — the HMAC computation happens entirely in your browser using the Web Crypto API; the key and message never leave your device.
Because everything runs locally, you can generate or verify a webhook signature without pasting your secret key into an unfamiliar external service.