HMAC Generator & JWT Token Builder

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512. Automatically builds JWT tokens from JSON payloads.

Last Updated: August 2026
100% Client-Side — Your data never leaves your device

Note: All HMAC and JWT generation happens entirely in your browser using the Web Crypto API. Your secret key never leaves your device.

For JWT generation, the payload must be valid JSON. The tool will automatically generate a JWT token with the standard header {"alg": "HS256", "typ": "JWT"}.

Why this tool is safe

Your data never leaves your device — everything runs in your browser.

No server uploads. Other tools send your files to their servers. Ours don't.
Zero tracking of content. We never see, store, or log anything you convert.
Works offline. Once loaded, the tool works without an internet connection.

HMAC Generation in Code

Generate HMAC-SHA256/384/512 signatures programmatically.

Python
import hmac
import hashlib
import base64

secret = "my-secret-key".encode()
payload = '{"user":"alice","role":"admin"}'.encode()

# HMAC-SHA256 (hex output)
sig = hmac.new(secret, payload, hashlib.sha256).hexdigest()
print(sig)  # e.g. a1b2c3d4...

# HMAC-SHA256 (Base64 output)
sig_b64 = base64.b64encode(
    hmac.new(secret, payload, hashlib.sha256).digest()
).decode()
print(sig_b64)

# Verify a webhook signature
def verify_webhook(payload: bytes, sig: str, secret: bytes) -> bool:
    expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

Frequently Asked Questions

Search below or browse through our most commonly asked questions.

HMAC (Hash-based Message Authentication Code) is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key.
No. The HMAC generation happens entirely client-side in your browser using the Web Crypto API.