HMAC Generator Online — SHA-256, SHA-512 + Base64
HMAC generator online — sign payloads with SHA-256, SHA-512, SHA-384, SHA-1. Hex / Base64 / Base64URL output. Webhook + JWT HS256 ready. No signup.
PDFFlare's HMAC generator online signs any payload with any standard HMAC algorithm in seconds. Use it as an hmac sha256 generator for Stripe, GitHub, Slack, and Shopify webhook signatures. Use it as an hmac sha512 generator for JWT alg HS512 tokens. Use it as a webhook signature generator when building or debugging a webhook receiver. Or use it as an hmac calculator online for AWS Signature v4 derived-key chains (run four HMAC-SHA-256 stages, paste each result into the secret for the next).
Three things make this dedicated tool more powerful than a generic hash tool: (1) secret format toggle — decode your key from text, hex, or base64 without manual conversion; (2) output format toggle — get the digest in lowercase hex (Stripe, AWS), UPPERCASE hex (Microsoft world), Base64, or Base64 URL (JWT) without a second tool; (3) generate random key mints a fresh 256-bit signing secret in your chosen format. Pair with the JWT Decoder to inspect tokens you sign, or with the Hash Generator for non-keyed text hashing, or with File Checksum for download integrity verification.
Computation runs entirely in your browser via Web Crypto's crypto.subtle.importKey() and crypto.subtle.sign(). The secret never leaves the page, never reaches a server, never lands in a log. Safe for development webhook secrets, JWT signing keys, and any payload you wouldn't paste into a third-party debugger. RFC 4231 test vectors verified.
The secret never leaves your browser. PDFFlare cannot see, store, or transmit it.
Enter both a secret and a message above to compute the HMAC.
How to Generate HMAC Signatures
Pick the algorithm
HMAC-SHA-256 for Stripe, GitHub, Slack, JWT HS256, and AWS Signature v4 — that's the modern default. HMAC-SHA-512 for JWT HS512. HMAC-SHA-384 for HS384. HMAC-SHA-1 only for legacy compatibility (older Twilio, AWS Signature v2). The ? button next to the selector shows what each algorithm is and where it's used.
Pick the secret format
Text for plain UTF-8 webhook secrets (Stripe and GitHub both use this). Hex for keys stored as hexadecimal strings. Base64 for keys in base64 encoding. The tool decodes the secret bytes correctly so you don't have to convert formats by hand. Or click "Generate random key" to mint a fresh 256-bit key.
Paste the message
The exact bytes the sender hashed. For Stripe webhooks: timestamp.body. For GitHub: just the body. For Slack: v0:timestamp:body. The construction is provider-specific and the source of most signature mismatches — see the FAQs for each provider's recipe.
Pick the output format and copy
Lowercase hex is what Stripe + GitHub + AWS expect. UPPERCASE hex matches Microsoft conventions. Base64 covers some legacy webhook headers. Base64 URL is for JWT signatures (the bytes that go after the second dot). The HMAC updates live as you type; click Copy to put the digest on your clipboard.
When Do You Need an HMAC Generator Online?
Verifying webhook signatures (Stripe, GitHub, Slack, Shopify): Your endpoint receives a webhook with a signature header that doesn't match what your code computes. The fastest way to debug is to compute the HMAC manually here, side by side with what your code produces, and find which one drifted. Paste the body, paste the secret, pick the algorithm, get the signature. Mismatch always points at the construction (timestamp prefix? raw body? wrong secret?).
Signing JWTs (alg HS256, HS384, HS512): JWT signatures in the HS family are HMAC over the base64url-encoded header.payload joined by a dot. Compute the HMAC with this tool, set output format to Base64 URL, and you have the signature bytes. Append after a third dot for a complete signed JWT. Useful for hand-crafting test tokens or verifying that your auth library produces the digest you expect.
AWS Signature v4 derived signing key: AWS Signature v4 chains four HMAC-SHA-256 calls to derive its signing key. Compute each stage in this tool: HMAC of date with `AWS4`+secret as the key, then HMAC of region with that result, then service, then `aws4_request`. Paste the result of each stage into the secret field for the next stage (set secret format to hex). Whichever stage produces a different digest from your code is where the bug lives.
Building a webhook receiver from scratch: You're writing a new webhook integration and need to verify your code's output against a known-good implementation. Use this hmac calculator online as the reference: paste the same body + secret your code is processing, compute the expected digest, compare. Same pattern for any custom HMAC pipeline — Discord bots, internal service mesh signing, idempotency-key signing, SaaS integrations.
Why Use PDFFlare's HMAC Generator?
Four Algorithms + Four Output Formats
HMAC-SHA-1, SHA-256, SHA-384, SHA-512 covering every modern provider. Output as lowercase hex, UPPERCASE hex, Base64, or Base64 URL — no second tool needed to convert.
Secret Format Decoder
Toggle between text, hex, and base64 secret encodings. The tool decodes your key bytes correctly so you don't have to do the conversion in a separate step. Plus a one-click random-key generator for fresh signing secrets.
100% Browser-Based
Web Crypto handles the HMAC math natively. Your secret and your payload never leave your machine — safe for production webhook secrets and JWT signing keys.
No Signup Required
Free, unlimited, no account, no rate limits. Bookmarkable for the next time a webhook integration breaks at 2 AM. Algorithm + format choices persist across sessions via localStorage (the secret is never stored).