Zum Hauptinhalt springen
DevCodivo

HMAC-Generator

Erstelle kryptografische HMAC-Signaturen (SHA-256, SHA-512, SHA-384) mit Hex- und Base64-Ausgabe.

Läuft in deinem Browser; deine Daten verlassen dein Gerät nieKostenlos, ohne Anmeldung
58 B

So funktioniert es

HMAC combines a secret key with your message using a two-pass cryptographic hash process as defined in RFC 2104. The key is padded with inner and outer constants (ipad and opad), and hashes are nested:HMAC(K, m) = H((K' ⊕ opad) ∥ H((K' ⊕ ipad) ∥ m)).

Because the hash cannot be computed or forged without the secret key, any party holding the key can verify that the message originated from a trusted sender and was not modified in transit.

Funktionen

  • Supports HMAC-SHA256, HMAC-SHA512, and HMAC-SHA384
  • Built on the platform Web Crypto API (no external libraries)
  • Hexadecimal (lowercase/uppercase) and Base64 output representations
  • Secret key visibility toggle for privacy during screen sharing
  • Instant sample payload and key for quick webhook verification tests
  • 100% client-side: keys and messages never leave your browser

So wird es verwendet

  1. Enter or paste the message or webhook payload into the Message field.
  2. Enter your shared Secret Key (click the eye icon to show/hide).
  3. Choose your desired algorithm: HMAC-SHA256, HMAC-SHA512, or HMAC-SHA384.
  4. Click Generate HMAC.
  5. Copy either the Hex or Base64 signature for your application.

Beispiel

Message:    {"event": "payment.succeeded", "amount": 2500}
Secret Key: whsec_test_secret_key_12345
Algorithm:  HMAC-SHA256

Hex:        34d1bc945bfb6c97a892705ddb2b8dd89547ea87588e36780824bba5b89eb00f
Base64:     NNG8lFv7bJeoknBd2yuN2JVH6odYjjZ4CCS7pbiesA8=

Häufig gestellte Fragen

What is an HMAC?
HMAC stands for Hash-based Message Authentication Code. It is a cryptographic mechanism (defined in RFC 2104) that combines a cryptographic hash function (such as SHA-256 or SHA-512) with a secret key to verify both the data integrity and authenticity of a message.
Which HMAC algorithms are supported?
DevCodivo supports HMAC-SHA256, HMAC-SHA512, and HMAC-SHA384. All calculations use the browser's native Web Crypto API for maximum security, standards compliance, and speed.
Is my secret key or message sent to a server?
Never. HMAC generation occurs 100% locally on your computer via window.crypto.subtle. Your secret keys, webhook secrets, and confidential payloads are never transmitted across the network.
Where are HMAC signatures typically used?
HMACs are the standard for securing webhook payloads (such as GitHub, Stripe, Shopify, and Slack webhooks), signing API requests (e.g. AWS Signature Version 4), generating HS256 JSON Web Tokens (JWT), and validating IoT telemetry messages.
Which output formats are provided?
Signatures are provided in both Hexadecimal (with lowercase and uppercase options) and Base64 encoding, satisfying the requirements of virtually all REST APIs and webhook verification libraries.

Verwandte Tools