What's the difference between a hash and an HMAC?

A plain hash (like SHA-256) only depends on the message — anyone can compute it. An HMAC mixes in a secret key, so it also proves the message came from someone who knows that key. That makes HMAC suitable for verifying API request signatures, webhook payloads, and message integrity where a plain hash isn't.

Which algorithm should I use?

HMAC-SHA256 is the standard default and what most APIs (Stripe, AWS, GitHub webhooks) use. HMAC-SHA1 is included for compatibility with older systems but is weaker. HMAC-SHA384/512 give a larger output for extra margin if a spec calls for it.

Is my message or secret key uploaded anywhere?

No. The HMAC is computed locally using the browser's built-in Web Crypto API (crypto.subtle.importKey / sign) — neither the message nor the secret is sent to a server.

Why do my HMAC and a server's HMAC not match?

The most common causes are mismatched text encoding (make sure both sides use UTF-8 and identical whitespace/line endings), a secret key typed with extra spaces, or the server hashing raw bytes (like a JSON body) rather than the string you pasted here. Double-check the exact bytes being signed on both ends.

HMAC GENERATOR

Type a message and a secret key, get HMAC-SHA1/256/384/512 instantly. Computed with the Web Crypto API, right in your browser.

Message

Secret key

HMAC-SHA1

—

HMAC-SHA256

—

HMAC-SHA384

—

HMAC-SHA512

—

How to generate an HMAC

1
Type or paste the message you want to authenticate.
2
Type the shared secret key.
3
Choose hex or Base64 for the output format.
4
Read off the HMAC-SHA1/256/384/512 digests — they update as you type — and click Copy on the one you need.

Questions

What's the difference between a hash and an HMAC?: A plain hash (like SHA-256) only depends on the message — anyone can compute it. An HMAC mixes in a secret key, so it also proves the message came from someone who knows that key. That makes HMAC suitable for verifying API request signatures, webhook payloads, and message integrity where a plain hash isn't.
Which algorithm should I use?: HMAC-SHA256 is the standard default and what most APIs (Stripe, AWS, GitHub webhooks) use. HMAC-SHA1 is included for compatibility with older systems but is weaker. HMAC-SHA384/512 give a larger output for extra margin if a spec calls for it.
Is my message or secret key uploaded anywhere?: No. The HMAC is computed locally using the browser's built-in Web Crypto API (crypto.subtle.importKey / sign) — neither the message nor the secret is sent to a server.
Why do my HMAC and a server's HMAC not match?: The most common causes are mismatched text encoding (make sure both sides use UTF-8 and identical whitespace/line endings), a secret key typed with extra spaces, or the server hashing raw bytes (like a JSON body) rather than the string you pasted here. Double-check the exact bytes being signed on both ends.