HMAC Generator
Compute Hash-based Message Authentication Codes (HMAC) for given messages and secret keys.
HMAC Generator
Output (hex)
How to generate an HMAC
Compute a Hash-based Message Authentication Code (HMAC) for a message and secret key, using the browser's built-in Web Crypto API.
HMAC vs. a plain hash
A plain hash (like SHA-256) only proves a message wasn't altered, but anyone can compute it. An HMAC mixes in a secret key, so only someone who knows that key can produce or verify a matching code — proving both integrity and that the sender knew the secret.
How to use it
- Enter the message to authenticate.
- Enter the shared secret key.
- Pick SHA-256, SHA-384, or SHA-512, and copy the resulting hex digest.
Choosing an algorithm
SHA-256 is the most common default and is what most APIs expect (for example, AWS request signing and many webhook signature schemes). SHA-384 and SHA-512 produce longer digests for services that specifically require them.
Privacy
Runs locally in your browser using the Web Crypto API. Neither the message nor the secret key is sent to the server.
FAQ
Is HMAC the same as encryption?
No. HMAC is one-way, like a hash — it authenticates a message but doesn't hide or encrypt its contents.
Is my secret key sent anywhere?
No. The HMAC is computed locally with the browser's Web Crypto API; the key and message never leave your device.
Which algorithm should I pick?
SHA-256 unless the service you're integrating with specifically documents SHA-384 or SHA-512.