HMAC
HMAC of text with a secret key using MD5, SHA-1, SHA-2, SHA-3 or SM3. The key is a separate input and is never saved with workflows.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Optional: Algorithm, Key format, Output
Run
Processes in this browser; cancel at any time
About this tool
Calculate an HMAC of text with a secret key, such as the HMAC-SHA256 signature many APIs and webhooks require. Use it to debug a signature the server rejects by signing the exact same string yourself, or to check the signature on a webhook you received.
It offers HMAC with MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512 and SM3. The key can be text, hex or Base64, and the result hex or Base64. Up to 1 MB is processed in your browser: text and key are not uploaded, and the key is never saved with workflows.
How to use it
- Put the message in “Text” and the secret in “Key (not saved with workflows)”, or select Use example to load a sample request string and key.
- Choose the “Algorithm” (HMAC-SHA256 by default) and the “Key format”.
- Choose the “Output”: lowercase hex, uppercase hex or Base64.
- Select Run, then preview the HMAC and download it as hmac.txt.
Formats and limits
- Input
- Text
- Output
- Plain text
- Size limit
- 1 MB
- Settings
- Algorithm; Key format (Text, Hex, Base64); Output (Hex, lowercase, Hex, uppercase, Base64)
- Privacy
- Text and keys stay in this browser session and are not uploaded. Keys are an input, so they are never saved with workflows or recipes.
- Price
- Free, no sign-up
Common questions
Why does my HMAC not match the server’s?
The message must be identical byte for byte: check spaces, line breaks, parameter order and URL encoding. The text is used as UTF-8, and everything in the “Text” box counts, including a line break at the end.
When should the key format be hex or Base64?
Choose “Hex” or “Base64” when your provider gives the secret in that encoding and its documentation says to decode it first; otherwise use “Text (UTF-8)”. The same characters give a different key in each format, and so a different HMAC.
Are spaces and line breaks in the key kept?
One line break at the end of the key is removed, since it is almost never part of the secret. Spaces and everything else you type are kept.
Should the result be hex or Base64?
Both are spellings of the same bytes, so a correct HMAC can look completely different in each. Use the one the API documents; Base64 here is the standard alphabet with = padding.
Is HMAC the same as hashing the key and the text together?
No. HMAC mixes the key in twice in a fixed construction, so its result differs from the MD5 or SHA-256 of the key joined to the text. For a plain hash, use “Hash text (MD5, SHA, SM3)”.
Related tools
Hash text (MD5, SHA, SM3)
MD5, SHA-1, SHA-2, SHA-3, Keccak, RIPEMD-128/160/256/320, SM3, BLAKE2 and BLAKE3 digests of text, hex or Base64 input, optionally line by line.
File checksums
MD5, SHA-1, SHA-256, SHA-512, SHA3-256, SM3, BLAKE3, CRC-32 or xxHash64 of up to 50 files of any type, read as a stream so large files work.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
JWT sign
Sign a JSON payload as a JWT with HS, RS, PS, ES or EdDSA algorithms, optionally adding issue and expiry times. Secrets and private keys are a separate input and are never saved with workflows.
JWT verify
Check a JWT’s signature with a secret, public key, certificate or JWK, and optionally its expiry and start times. Unsigned tokens and HMAC tokens checked against a public key are rejected.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.