HMAC Generator
Everything runs in your browser. Your message and key are never sent.
What is HMAC Generator
An HMAC (hash-based message authentication code) combines a message with a secret key to produce a fixed-size signature that proves the message came from someone who holds the key and was not altered. This generator computes the HMAC with SHA-1, SHA-256, SHA-384, or SHA-512 using the Web Crypto API, entirely in your browser. Your message and key never leave the page.
How to use
- Type or paste the message you want to authenticate.
- Enter the shared secret key.
- Pick the hash algorithm (SHA-256 is the common default).
- Copy the hex HMAC from the output box.
When to use it
Need to sign a webhook payload or verify an API request the way many services do? Paste the message, enter the shared secret, and you get the exact hex HMAC to compare against the one a server produced. Developers use it to test signature checks, debug webhook verification, and confirm two systems agree on the same key and algorithm.
Frequently asked questions
What is the difference between HMAC and a plain hash?
A plain hash like SHA-256 anyone can compute from the message alone. An HMAC also mixes in a secret key, so only someone with that key can produce or verify the same code. That is what authenticates the message.
Which algorithm should I use?
SHA-256 is the common default and a safe choice. Match whatever the other system expects. SHA-1 is still seen in older APIs but is weaker, so prefer SHA-256 or above for new work.
Are my message and key sent anywhere?
No. The HMAC is computed in your browser with the Web Crypto API. Nothing you type is uploaded, logged, or stored.
Related tools
AES Text Decryption
Decrypt AES-256 encrypted text with your password in your browser. Free, private, and fully offline. No data leaves your device.
AES Text Encryption
Encrypt text with a password using AES-256 in your browser. Free, private, and fully offline. Nothing is sent to a server.
Atbash Cipher Encoder and Decoder
Encode and decode the Atbash cipher online. Atbash mirrors the alphabet and is its own inverse, so one click scrambles and unscrambles. Free and private.