--- title: "HMAC Generator - Free Online Tool | CanDoYa" description: "Free online HMAC generator to compute message authentication codes with SHA-1, SHA-256, SHA-384 or SHA-512. No sign-up, no download - runs in your browser." url: https://candoya.com/tools/hmac-generator/ locale: en type: browser-tool --- # Free HMAC Generator Category: Developer ## What is an HMAC? An HMAC (Hash-based Message Authentication Code) is a cryptographic signature that proves a message came from a trusted sender and hasn't been altered. It combines a secret key with a hash algorithm to create a unique code for each message - unlike a plain hash, HMAC authenticates AND integrity-checks simultaneously, making it essential for APIs, webhooks and secure communications. This tool computes HMACs using your browser's native WebCrypto, supporting SHA-1, SHA-256, SHA-384 and SHA-512 hash algorithms. Both the message and secret key are processed locally on your device - nothing is uploaded or sent to a server, so even sensitive authentication keys stay private. ## How to use it 1. **Enter your message** - Paste or type the text you want to authenticate in the Message field. 2. **Provide your secret key** - Enter the secret key used to compute the HMAC. This key must be kept confidential. 3. **Choose hash algorithm and encoding** - Select your hash algorithm (SHA-256 is the modern standard) and output format (hex or base64). 4. **Copy the HMAC** - The computed HMAC appears instantly. Click Copy to send it to your clipboard. ## Who it's for - **API authentication** - sign requests to third-party APIs that require HMAC-based signatures (AWS, Stripe, GitHub webhooks). - **Webhook verification** - validate incoming webhook payloads by comparing the received HMAC against your computed signature. - **Data integrity checks** - ensure files or messages haven't been tampered with during transmission or storage. - **Token generation** - create secure tokens for session management, password resets or two-factor authentication flows. ## Expert note HMAC uses a keyed hash construction (key + message + hash algorithm) that makes it impossible to forge without knowing the secret key - even if an attacker sees many HMAC outputs, they cannot reverse-engineer the key or predict future codes. This is why HMAC is the gold standard for API authentication and webhook verification, whereas plain hashes (SHA-256 alone) only detect accidental corruption, not malicious tampering. ## Frequently asked questions ### Is this HMAC generator free? Yes - 100% free, no sign-up, no limits. It runs entirely in your browser. ### Is my secret key sent anywhere? No. Everything is processed locally in your browser using WebCrypto. Your message and key never leave your device - nothing is uploaded to a server. ### What is the difference between HMAC and a plain hash? A plain hash (like SHA-256) detects accidental changes but anyone can compute it. HMAC adds a secret key, so only someone who knows the key can produce the correct code - this authenticates the message origin and proves it hasn't been tampered with. ### Which hash algorithm should I use? SHA-256 is the modern standard and recommended for new projects. SHA-1 is legacy and considered weak for cryptography. SHA-384 and SHA-512 offer longer digests for higher security requirements. ### What does 'empty key' mean? If you leave the key field blank, the tool treats it as a zero-byte key (0x00), which is the standard HMAC behavior for empty keys. This is valid but not recommended for real authentication - always use a strong, non-empty secret key. ### Should I use hex or base64 encoding? Hex (hexadecimal) is human-readable and commonly used in documentation. Base64 is more compact and often used in APIs and protocols. Choose whichever your system expects - they encode the same HMAC bytes differently. ### Can I use this for production authentication? Yes - this tool uses the browser's native WebCrypto, which is the same cryptographic engine used by production systems. However, for server-side authentication, use a backend library (Node.js crypto, Python hmac, etc.) to keep your secret key secure. ## Related tools - [SHA-256 Hash Generator](https://candoya.com/tools/sha-256-hash/) - [File Hash Calculator](https://candoya.com/tools/file-hash/) - [TOTP Code Generator](https://candoya.com/tools/totp-code-generator/) - [Password Generator](https://candoya.com/tools/password-generator/) - [Base64 Encode and Decode](https://candoya.com/tools/base64-encode-decode/) --- *Markdown edition of , published for AI agents and other automated readers. Index of key pages: .*