HMAC Generator Online

If you are integrating Stripe webhooks or building a JSON Web Token (JWT) system, you must generate an HMAC (Hash-based Message Authentication Code) to prove the payload hasn't been tampered with. This tool is built to generate secure cryptographic signatures instantly for API debugging.

The SubtleCrypto API

You should never paste a production SECRET_KEY into a random web tool. To make this generator completely secure, it is built on the browser's native SubtleCrypto API. The cryptographic math combining your payload and your Secret Key happens entirely in your local RAM. The key never touches a network connection.

Why HMAC is Different

A standard SHA-256 hash is public; anyone can hash the word "Hello". An HMAC is secure because the payload is mathematically salted with a private Secret Key. The receiving server runs the exact same math. If the resulting signatures match, the server knows mathematically that the data is authentic and the sender possesses the correct key.

Hex vs Base64 Output

Most APIs (like GitHub or Stripe) expect the final HMAC signature to be formatted as a Hexadecimal string. Others (like JWT headers) expect a Base64 string. The tool allows you to toggle the output encoding instantly, without altering the underlying cryptographic hash.