This tool computes HMACs using your browser's native WebCrypto, supporting SHA-1, SHA-256, SHA-384 and SHA-512 hash algorithms. Both the message and secret key are processed locally on your device - nothing is uploaded or sent to a server, so even sensitive authentication keys stay private.
Private browser utility / Developer
Free HMAC Generator
Runs entirely in your browser - no upload, no sign-up.
What is an HMAC?
An HMAC (Hash-based Message Authentication Code) is a cryptographic signature that proves a message came from a trusted sender and hasn't been altered. It combines a secret key with a hash algorithm to create a unique code for each message - unlike a plain hash, HMAC authenticates AND integrity-checks simultaneously, making it essential for APIs, webhooks and secure communications.
02
How to use
- 01Enter your message
Paste or type the text you want to authenticate in the Message field.
- 02Provide your secret key
Enter the secret key used to compute the HMAC. This key must be kept confidential.
- 03Choose hash algorithm and encoding
Select your hash algorithm (SHA-256 is the modern standard) and output format (hex or base64).
- 04Copy the HMAC
The computed HMAC appears instantly. Click Copy to send it to your clipboard.
03
Who it's for
- API authentication - sign requests to third-party APIs that require HMAC-based signatures (AWS, Stripe, GitHub webhooks).
- Webhook verification - validate incoming webhook payloads by comparing the received HMAC against your computed signature.
- Data integrity checks - ensure files or messages haven't been tampered with during transmission or storage.
- Token generation - create secure tokens for session management, password resets or two-factor authentication flows.
FAQ
Is this HMAC generator free?
Yes - 100% free, no sign-up, no limits. It runs entirely in your browser.
Is my secret key sent anywhere?
No. Everything is processed locally in your browser using WebCrypto. Your message and key never leave your device - nothing is uploaded to a server.
What is the difference between HMAC and a plain hash?
A plain hash (like SHA-256) detects accidental changes but anyone can compute it. HMAC adds a secret key, so only someone who knows the key can produce the correct code - this authenticates the message origin and proves it hasn't been tampered with.
Which hash algorithm should I use?
SHA-256 is the modern standard and recommended for new projects. SHA-1 is legacy and considered weak for cryptography. SHA-384 and SHA-512 offer longer digests for higher security requirements.
What does 'empty key' mean?
If you leave the key field blank, the tool treats it as a zero-byte key (0x00), which is the standard HMAC behavior for empty keys. This is valid but not recommended for real authentication - always use a strong, non-empty secret key.
Should I use hex or base64 encoding?
Hex (hexadecimal) is human-readable and commonly used in documentation. Base64 is more compact and often used in APIs and protocols. Choose whichever your system expects - they encode the same HMAC bytes differently.
Can I use this for production authentication?
Yes - this tool uses the browser's native WebCrypto, which is the same cryptographic engine used by production systems. However, for server-side authentication, use a backend library (Node.js crypto, Python hmac, etc.) to keep your secret key secure.