Hmac generator

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from Hmac generator

HMAC Generator calculates a hash-based message authentication code from text, a secret key, and a selected hash function. The workspace exposes separate controls for key encoding and output encoding, which are essential when comparing its result with another implementation. It accepts text rather than an uploaded file and updates the HMAC result as the inputs change. HMAC authenticates exact message bytes under a shared key; it does not encrypt the message, distribute the key, or establish who supplied a message unless the surrounding protocol manages that trust. Use a disposable known example first, then match every encoding and message-construction rule of the integration you are investigating.

Guide updated October 13, 2026

How to use this tool

1. Enter the message in Plain text to compute the hash and enter the demonstration key in Secret key.
2. Select Key encoding. Use Plain text for the literal key value key in the example, or Hexadecimal text when the field contains encoded key bytes.
3. Select SHA256 under Hashing function and Hexadecimal under Output encoding to reproduce the example digest.
4. Inspect HMAC of your text and use Copy HMAC. Compare the result only with a calculation using the same key bytes, message bytes, hash function, and output representation.

SEE IT IN PRACTICE

A worked example

Hashing function: SHA256
Key encoding: Plain text
Secret key: key
Message: The quick brown fox jumps over the lazy dog
Output encoding: Hexadecimal

f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8

Use the exact message without a trailing newline. The key is the literal text key. Entering 6b6579 with Hexadecimal key encoding represents the same key bytes, while entering those six characters as Plain text represents a different key.

Match bytes before comparing results

A common integration failure is authenticating a reformatted message instead of the original bytes required by the protocol. Pretty-printing JSON, changing line endings, trimming a body, or adding a timestamp in a different order changes the calculation. Write down the exact sequence being authenticated and test it with a synthetic message. This form is a text-oriented calculator, so it is not a substitute for testing arbitrary binary request bodies in the actual receiving code.

Generation is one part of a verification workflow

A receiver must use the protocol's expected algorithm and trusted key, construct the same message bytes, decode the supplied signature correctly, and compare authentication values using an appropriate verification implementation. Other protocol checks, such as timestamps and replay handling, are separate from the HMAC arithmetic. The tool generates a value for inspection; it does not validate a complete webhook exchange or decide whether a request should be authorized. Keep a reproducible synthetic test with the integration so later encoding changes can be detected.

When this tool is useful

• Reproduce a synthetic webhook-signature calculation
• Check interoperability between HMAC implementations
• Compare text-key and hexadecimal-key representations

Tips for a better result

• Treat the key as a credential. Use disposable keys in screenshots, shared examples, and troubleshooting reports.
• Keep message canonicalization separate from hashing: whitespace, JSON property order, newline style, and encoding can change the bytes that are authenticated.
• Choose the algorithm and output representation required by the protocol. The presence of an algorithm in a menu is not a recommendation to use it for a new design.

Frequently asked questions