Best Online HMAC Generators Compared (2026)
If you are debugging a webhook signature failure, testing an API request signing flow, or validating a JWT HS256 token, you need a reliable HMAC generator. But not all online HMAC tools are equal — some only support HMAC-SHA256, some upload your secret key to a server, and most lack HMAC verification mode. We tested the top online HMAC generators so you can pick the right one.
Quick Comparison Table
| Feature | CardWise HMAC | DevGlan HMAC | FreeFormatter | HashGenerator.co | IT Tools |
|---|---|---|---|---|---|
| Algorithm range | HMAC-MD5, SHA1, SHA256, SHA384, SHA512 | HMAC-MD5, SHA1, SHA256, SHA384, SHA512 | HMAC-MD5, SHA1, SHA256, SHA384, SHA512 | HMAC-SHA256, SHA512 | HMAC-SHA256, SHA512 |
| Key format: Text | Yes | Yes | Yes | Yes | Yes |
| Key format: Hex | Yes | No | No | No | No |
| Key format: Base64 | Yes | No | No | No | No |
| HMAC verification mode | Yes (MATCH / NO MATCH) | No | No | No | No |
| Multi-algo view | Yes (all at once) | No (one at a time) | No (one at a time) | No | No |
| Preset scenarios | 5 (API Sig, JWT, AWS, Webhook, OTP) | No | No | No | No |
| Client-side only | Yes (zero upload) | No (server) | No (server) | Yes | Yes (Web Crypto) |
| Real-time computation | Yes (as-you-type) | No | No | Yes | Yes |
| Copy button per result | Yes | No | No | Yes | Yes |
| Mobile friendly | Yes | Basic | Yes | Yes | Yes |
| Privacy | Best (no server) | Poor (server) | Poor (server) | Good (client) | Good (client) |
| Price | Free | Free | Free | Free | Free |
1. CardWise HMAC Generator — Most Complete
CardWise is the only free online HMAC generator with built-in HMAC verification mode. Instead of just computing an HMAC value, you can paste the expected signature and instantly see whether it matches — invaluable for debugging webhook signature failures and API authentication issues.
Key advantages for developers and security engineers:
- Five HMAC algorithms — HMAC-MD5, HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512, all computed simultaneously
- HMAC verification mode — paste an expected HMAC value, get real-time MATCH / NO MATCH feedback
- Three key formats — Text, Hex, and Base64 key input for compatibility with any API signing scheme
- Five preset scenarios — API Signature, JWT HS256, AWS Sig v4, Webhook Secret, HOTP/OTP with one-click load
- Zero data upload — uses the browser’s native Web Crypto API (crypto.subtle), with a pure-JS fallback for HMAC-MD5
- Multi-algorithm view — see all five HMAC results at once with per-result copy buttons
2. DevGlan HMAC Generator — Popular Multi-Algorithm
DevGlan is one of the most visited online HMAC tools, supporting the full range of HMAC algorithms (MD5 through SHA512) with a straightforward interface. You select an algorithm, enter a key and message, and get the HMAC output.
Pros: Wide algorithm coverage (MD5 through SHA512), clean interface, well-known in developer community.
Cons: Server-side processing (your secret key is uploaded), no HMAC verification mode, one algorithm at a time, no key format options (text only), no presets, no real-time computation.
3. FreeFormatter HMAC Generator — Clean UI
FreeFormatter offers a straightforward HMAC generator with a clean, ad-supported interface. It supports the standard HMAC algorithm range and provides output in multiple encoding formats.
Pros: Clean UI, multiple output encodings (Hex, Base64), algorithm selection dropdown, well-known tool site.
Cons: Server-side processing, no HMAC verification mode, one algorithm at a time, text-only key input, no presets, no real-time feedback.
4. HashGenerator.co — Client-Side with Hash+HMAC
HashGenerator.co combines hash calculation and HMAC generation in a single interface. It runs client-side and supports HMAC-SHA256 and HMAC-SHA512 alongside plain hash algorithms.
Pros: Client-side (no data upload), real-time computation, includes both hash and HMAC modes, copy buttons on results.
Cons: Limited to HMAC-SHA256 and HMAC-SHA512 (no MD5, SHA1, SHA384), no HMAC verification mode, no key format options, no preset scenarios.
5. IT Tools — Open Source Client-Side
IT Tools (it-tools.tech) is an open-source developer toolbox that includes an HMAC generator among its 80+ tools. The code is available on GitHub for audit and runs entirely in the browser.
Pros: Open source (auditable), client-side via Web Crypto API, clean modern UI, real-time computation, includes HMAC-SHA256 and SHA512.
Cons: Limited algorithm range (SHA256, SHA512 only), no HMAC verification mode, no key format options (text only), no preset scenarios, no multi-algorithm view.
Which HMAC Generator Should You Use?
| Use Case | Recommended Tool | Why |
|---|---|---|
| Webhook signature debugging | CardWise HMAC | Verification mode (MATCH/NO MATCH) + HMAC-SHA256 + client-side |
| JWT HS256 token validation | CardWise HMAC | JWT HS256 preset + HMAC-SHA256 + verification |
| AWS Signature V4 testing | CardWise HMAC | AWS Sig v4 preset + HMAC-SHA256 + Hex key support |
| Multi-algorithm HMAC testing | CardWise HMAC | All 5 algorithms simultaneously + per-result copy |
| Quick HMAC-SHA256 (non-sensitive) | DevGlan or FreeFormatter | Simple interfaces, wide algorithm range |
| Open-source auditable code | IT Tools | GitHub available, client-side, trusted |
| Hash + HMAC combined | HashGenerator.co | Both modes in one tool, client-side |
HMAC Algorithms Quick Reference
Not sure which HMAC algorithm to use? Here is a quick reference:
| Algorithm | Output Size | Common Use | Security Status |
|---|---|---|---|
| HMAC-MD5 | 128 bit | Legacy systems, HOTP/OTP | Legacy only |
| HMAC-SHA1 | 160 bit | Legacy API signatures, OAuth 1.0 | Legacy only |
| HMAC-SHA256 | 256 bit | JWT HS256, AWS Sig v4, webhooks | Recommended |
| HMAC-SHA384 | 384 bit | Specific compliance requirements | Secure |
| HMAC-SHA512 | 512 bit | High-security API signatures | Secure |
Frequently Asked Questions
What is HMAC and why do I need it?
HMAC (Hash-based Message Authentication Code) is a cryptographic technique that uses a secret key + a hash function to prove that a message has not been tampered with and came from someone who possesses the key. It is used in API request signing (AWS, Stripe), JWT tokens (HS256), webhook payload verification (GitHub, Slack), and OTP generation (HOTP). Unlike a plain hash, HMAC requires a secret key — an attacker cannot forge a valid HMAC without knowing the key.
Why does HMAC verification mode matter?
When debugging a webhook signature failure or API authentication error, you need to know whether your locally computed HMAC matches the expected value. Without verification mode, you must manually compare two long hex strings character by character. CardWise’s verification mode does this automatically — paste the expected HMAC, and you get an instant MATCH or NO MATCH result as you type.
Is it safe to use an online HMAC generator with my production API keys?
Only with client-side tools. CardWise, IT Tools, and HashGenerator.co run entirely in your browser — your secret key never leaves your device. Server-side tools like DevGlan and FreeFormatter transmit your key to their server for processing. For production API keys, webhook signing secrets, or OAuth tokens, always use a client-side tool.
What key format should I use for HMAC?
Most APIs use plain text keys (e.g., your Stripe signing secret). However, some systems — particularly AWS Signature V4 — use hex-encoded keys derived from your secret access key. JWT HS256 typically uses text keys. CardWise supports all three formats (Text, Hex, Base64) with a tab switcher, so you can match whatever format your API expects without manual conversion.