HMAC Generator — Free Online Tool

HMAC generator tools create keyed message signatures (like HMAC-SHA256) used to authenticate payloads and validate webhook requests. SWEDevTools: Prism generates HMAC locally using the Web Crypto API, so your secret key and message never leave your device and the tool works offline as an installable PWA. Paste the message, enter the shared secret, choose SHA-256/384/512, and output as hex or Base64 to match your integration. Since SWEDevTools: Prism supports pipelines, you can normalize inputs (JSON formatting or URL decoding) and then sign them in one repeatable chain—ideal for reproducing signature mismatches without ad-hoc scripts or online calculators. This keeps secrets private while you debug signature headers and canonicalization rules.

Features

• SHA-256/384/512: Modern HMAC algorithms for common signing flows.
• Hex or Base64 output: Match header formats and SDK expectations.
• Local-first privacy: No server processing—safer for secrets.
• Pipeline workflows: Normalize then sign in a repeatable chain.

Frequently Asked Questions

What is HMAC used for?

Authenticating messages with a shared secret (webhooks, API signing).

Hash vs HMAC?

HMAC uses a secret key; hashes do not.

Why don’t signatures match?

Usually input differences: whitespace, newlines, encoding, or different canonicalization.

Which algorithm should I use?

Use SHA-256 unless your provider requires SHA-384/512.

Hex vs Base64 output?

Use the format required by the receiving system.

Do you upload my secret key?

No—HMAC runs locally in your browser.

Can I verify a webhook signature here?

Generate the expected HMAC and compare with the signature you received.

Can I run offline?

Yes—install the PWA.

What happened to smalldev.tools?

smalldev.tools is no longer available. Prism by SWEDevTools offers the same developer tools and more, with offline support, pipeline chaining, and completely free usage — no signup required.

Is Prism a good alternative to CyberChef for hashing?

Yes. Prism generates hashes and HMACs entirely in your browser with no data uploads. Unlike CyberChef, Prism is purpose-built for developer workflows with pipeline chaining and a cleaner interface.