HMAC Generator
Generate HMAC (Hash-based Message Authentication Code) with various algorithms.
Helpful?
Thank You!
Thanks for your feedback!
Already Rated
You have already rated this tool.
Message
Secret Key
Options
HMAC Output
HMAC-SHA256
0 characters
0 bits
All Algorithms
| Algorithm | HMAC Value | Actions |
|---|---|---|
| SHA-256 | ||
| SHA-384 | ||
| SHA-512 | ||
| SHA-1 |
About HMAC: Hash-based Message Authentication Code (HMAC) combines a secret key with a hash function
to create a unique authentication code. It's commonly used for API authentication, data integrity verification,
and secure message transmission.
This free HMAC generator creates a keyed-hash message authentication code from your message and secret key, entirely in your browser using the Web Crypto API — your data never leaves your device.
Supported algorithms
Pick the underlying hash function to match the system you are integrating with:
- HMAC-SHA256 — the modern default, used by Stripe and GitHub webhooks and by JWTs signed with
HS256. There is also a focused HMAC-SHA256 generator. - HMAC-SHA384 and HMAC-SHA512 — longer digests for an extra security margin.
- HMAC-SHA1 — legacy systems and some older webhook providers.
Keys can be entered as text, hex, or Base64, and the code can be formatted as hex, Base64, or Base64URL to match your API.
Worked example
With the message Hello, World! and key my-secret-key, HMAC-SHA256 produces a 64-character (256-bit) hex digest. Change a single character of either input and the entire code changes — that is exactly what lets a receiver detect tampering.
Frequently Asked Questions
An HMAC generator combines a secret key with a hash function (such as SHA-256) to produce a message authentication code. Anyone holding the same key can confirm a message is authentic and unmodified, but nobody can forge the code without the key.
Use HMAC-SHA256 unless a system you are integrating with requires otherwise. It is the current standard for API request signing, webhooks and JWTs. SHA-1 should only be used for legacy compatibility.
Yes. All hashing happens locally in your browser via the Web Crypto API — your message and secret key are never sent to our servers.
A plain hash like SHA-256 verifies integrity, but anyone can compute it. HMAC mixes in a secret key so it also proves authenticity — only holders of the key can produce a valid code. See our guide to HMAC.
Recompute the HMAC over the received message with the shared secret key, then compare it to the received code using a constant-time comparison. If they match, the message is authentic.