Hex
—
Base64
—
About this tool
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature that proves both the integrity and authenticity of a message. It is widely used in API authentication (AWS SigV4, Stripe webhooks, JWT HS256), webhook verification, and session token signing. This tool uses the browser's native crypto.subtle API, your message and key never leave the browser. Choose SHA-256 for most use cases; SHA-384 and SHA-512 provide larger output for higher-security requirements.