HMAC Generator & JWT Token Builder

Generate HMAC signatures using SHA-256, SHA-384, or SHA-512. Automatically builds JWT tokens from JSON payloads.

Last Updated: September 2026
100% Client-Side — Your data never leaves your device

Note: All HMAC and JWT generation happens entirely in your browser using the Web Crypto API. Your secret key never leaves your device.

For JWT generation, the payload must be valid JSON. The tool will automatically generate a JWT token with the standard header {"alg": "HS256", "typ": "JWT"}.

Why this tool is safe

Your data never leaves your device — everything runs in your browser.

No server uploads. Other tools send your files to their servers. Ours don't.
Zero tracking of content. We never see, store, or log anything you convert.
Works offline. Once loaded, the tool works without an internet connection.
No account required. Instantly use all tools completely free without signing up.

HMAC Generation in Code

Generate HMAC-SHA256/384/512 signatures programmatically.

Python
import hmac
import hashlib
import base64

secret = "my-secret-key".encode()
payload = '{"user":"alice","role":"admin"}'.encode()

# HMAC-SHA256 (hex output)
sig = hmac.new(secret, payload, hashlib.sha256).hexdigest()
print(sig)  # e.g. a1b2c3d4...

# HMAC-SHA256 (Base64 output)
sig_b64 = base64.b64encode(
    hmac.new(secret, payload, hashlib.sha256).digest()
).decode()
print(sig_b64)

# Verify a webhook signature
def verify_webhook(payload: bytes, sig: str, secret: bytes) -> bool:
    expected = hmac.new(secret, payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

Frequently Asked Questions

Search below or browse through our most commonly asked questions.

HMAC (Hash-based Message Authentication Code) is a specific type of message authentication code involving a cryptographic hash function and a secret cryptographic key.
No. The HMAC generation happens entirely client-side in your browser using the Web Crypto API.

Related Tools

Base64 Converter

Encode text to Base64 or decode Base64 to text — all in one tool

JWT Encoder

Generate and sign JSON Web Tokens (JWT) using the HS256 algorithm securely

Basic Auth Decoder

Decode HTTP Basic Authentication headers to reveal username and password

Base64 Encoder

Encode plain text to Base64 format with UTF-8, ASCII, and ISO-8859-1 support