HMAC Online Generator

An HMAC message authentication code calculation tool supporting multiple algorithms such as MD5, SHA-1, SHA-2, and SHA-3, with single or batch calculation.

Bug report

Browser execution mode: Your data is processed in your browser and is not uploaded to the server.

Speed and Stability: Processing speed depends on your device and browser. For large batch work, the desktop version may be more stable.

Loading tool, please wait...

If the online tool fails to load or run, try the desktop tool.https://tools.yikeaigc.com/

Tool Usage

Return to old version

Set the algorithm, key encoding, and output format first, then enter a message or choose a file to process. A mismatched key format will affect the result. When verifying third-party signatures, keep the algorithm, key, and original message exactly the same.

Settings Set first

HMAC Algorithm

Secret Key

UTF-8 Text Hex Base64

Random Key Length

Key strength: empty 0 bytes

Output format

hex lowercase hex uppercase Base64 Base64URL

Input Message
Supports UTF-8, hex, and Base64 input. With live calculation enabled, results update automatically as content changes.

0 chars

UTF-8 Text Hex Base64

Live calculation

Verify message and signature
Use the same algorithm, key, and encoding settings on the left, then compare with the expected HMAC in constant time.

UTF-8 Text Hex Base64

Choose files
Supports any file type; the list shows only the first 20, but all selected files will be processed.

0 files

Drag files here, or click to choose Batch results can be copied or downloaded as a ZIP archive.

No files selected

Waiting 0%

Instructions

Software Usage Instructions

Set calculation parameters: First select the HMAC algorithm, then enter the key and confirm the key encoding format. For common API signatures, you can choose HMAC-SHA256.
Select output format: Supports lowercase hex, uppercase hex, Base64, and Base64URL. When verifying third-party signatures, keep it consistent with the other party's requirements.
Single calculation: Enter the message content in “Single Calculation,” select UTF-8, hexadecimal, or Base64 input format, and click “Calculate HMAC” to generate the result.
Examples and templates: You can click sample data or select templates such as GitHub Webhook, AWS style, WeChat Pay style, or JWT HS256 snippet to quickly fill in reference content.
Signature verification: Go to “Signature Verification,” enter the original message and expected HMAC value, and the tool will calculate the current value and determine whether it matches.
Batch file processing: Go to “Batch Files,” drag and drop or select multiple files, and click “Batch Calculate” to generate the HMAC result for each file. The list displays the first 20 files, while all files will be calculated during processing.
Export results: Single results can be copied or downloaded as TXT; batch results can be copied in full or downloaded as a ZIP archive containing CSV, TXT, JSON, and result text split by file.
Save settings: Click “Save Settings” to save the algorithm, key encoding, output format, and random key length. The key content will not be saved.

FAQ

A: HMAC is a message authentication code generated based on a hash function and a key, used to verify message integrity and source authenticity. Unlike a regular hash, it includes a key and is commonly used for API signatures, Webhook verification, and secure communication.

A: For everyday API signatures, HMAC-SHA256 is recommended. If compatibility with legacy systems is required, choose SHA-1 or MD5 according to the other party’s specifications; if a longer digest is needed, choose SHA-384, SHA-512, or the SHA3 series.

A: Common reasons include different algorithms, different keys, different input encodings, different output formats, or invisible characters such as spaces and line breaks in the message. Please check each parameter for consistency.

A: It is recommended to use a randomly generated high-strength string as the key and store it properly. For SHA-256 scenarios, a 32-byte random key is commonly used; for external platform signatures, use the key provided or agreed upon by the platform.

A: hex represents the digest using hexadecimal characters; Base64 is shorter and commonly used in API fields; Base64URL replaces characters that are inconvenient to use directly in URLs, and is common in scenarios such as JWT. Choose the format required by your business specifications.

A: First confirm the algorithm and key, then check whether the original message contains line breaks, spaces, escape characters, or differences in field order. Webhook and API signatures usually require the original request body or a canonicalized string.

A: After batch calculation is complete, you can download a ZIP archive containing CSV, TXT, and JSON summary files, as well as single-file result text files generated using the original file names. If duplicate names occur, numbers are automatically added to distinguish them.