HMAC & Bcrypt Generator
Generate and verify HMAC signatures and bcrypt password hashes in your browser.
Frequently Asked Questions
What is HMAC?
HMAC is a keyed hash. It combines a secret key with a message to produce a signature that only someone who knows the key can create or check, proving the message is authentic and unchanged. It is used for webhook signatures, API request signing and HS256 JWTs.
How do I generate an HMAC-SHA256?
Enter your message and secret key, choose HMAC-SHA256, and copy the result in hex or Base64. If your key is stored as hex or Base64, switch its format from Text so the raw bytes are used.
How do I verify a webhook signature?
Compute the HMAC of the exact raw request body with your signing secret, then paste the signature from the request header under Verify a signature. It accepts hex or Base64 and a sha256= prefix, and compares in constant time.
Why does my HMAC not match?
Almost always the message differs by a byte: a trailing newline, re-serialised JSON, or a different encoding. Also check that the key is entered in the right format and that you chose the same algorithm as the sender.
What is bcrypt?
Bcrypt is a deliberately slow password-hashing function. Each hash includes a random salt and a cost factor, so identical passwords produce different hashes and brute-forcing becomes expensive. A bcrypt hash is 60 characters starting with $2a$, $2b$ or $2y$.
What bcrypt cost factor should I use?
Every +1 doubles the time. OWASP says to use at least 10 for bcrypt. Choose the highest value your servers can check quickly enough on every login, and revisit it as hardware improves.
Is there a limit on bcrypt password length?
Yes. Bcrypt only uses the first 72 bytes of a password, so anything longer is ignored. The tool warns you when a password goes over.
Are my keys and passwords sent anywhere?
No. HMAC uses your browser's built-in Web Crypto and bcrypt runs as JavaScript on your device, so nothing you type leaves it. Even so, use test values rather than real production secrets.
Related Tools
Hash Generator
Generate hashes (MD5, SHA-1, SHA-256, etc.).
Password Generator
Create strong, secure, and random passwords.
JWT Encoder/Decoder
Encode and decode JSON Web Tokens.
OTP Generator
Generate and verify Time-Based One-Time Passwords (TOTP).
Base32 / Hex / ASCII Encoder
Encode and decode text as Base32, hexadecimal or ASCII character codes.