./prontouso.com

SECURITY

HMAC Generator

Compute Hash-based Message Authentication Codes (HMAC) for given messages and secret keys.

Tool statusRuns in your browser
Preview

HMAC Generator

Algorithm

Output (hex)

How it works

  1. Enter your input

    Fill in the values, paste your text, or upload the file this tool works with.

  2. See results instantly

    Most tools update live as you type; a few use a single button. Either way, the result appears right on this page.

  3. Use your results

    Copy, download, or share what the tool produces — you're always in control of the output.

Privacy and processing — Runs locally in your browser. This tool does not upload your input.

What is HMAC Generator?

Compute a Hash-based Message Authentication Code (HMAC) for a message and secret key, using the browser's built-in Web Crypto API.

UNDERSTAND THE TOOL

How to generate an HMAC

HMAC vs. a plain hash

A plain hash (like SHA-256) only proves a message wasn't altered, but anyone can compute it. An HMAC mixes in a secret key, so only someone who knows that key can produce or verify a matching code — proving both integrity and that the sender knew the secret.

How to use it

  • Enter the message to authenticate.
  • Enter the shared secret key.
  • Pick SHA-256, SHA-384, or SHA-512, and copy the resulting hex digest.

Choosing an algorithm

SHA-256 is the most common default and is what most APIs expect (for example, AWS request signing and many webhook signature schemes). SHA-384 and SHA-512 produce longer digests for services that specifically require them.

Digest format

The tool signs the UTF-8 message with the UTF-8 secret through Web Crypto and returns lowercase hexadecimal for SHA-256, SHA-384, or SHA-512.

Secret handling notes

The secret key and message are used only in the browser Web Crypto call. Clear them before leaving a shared device or screen.

Frequently Asked Questions

Is HMAC the same as encryption?

No. HMAC is one-way, like a hash — it authenticates a message but doesn't hide or encrypt its contents.

Is my secret key sent anywhere?

No. The HMAC is computed locally with the browser's Web Crypto API; the key and message never leave your device.

Which algorithm should I pick?

SHA-256 unless the service you're integrating with specifically documents SHA-384 or SHA-512.

Can I verify an HMAC with this tool?

Yes. Generate the HMAC from the same message, secret, and algorithm, then compare the hex digest with the expected value.

Related Tools