HMAC Generator
HMAC (Hash-based Message Authentication Code) proves that a message came from someone who holds a shared secret and was not tampered with. This generator computes HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 using the browser Web Crypto API.
HMAC proves a message came from someone holding the key — pair it with SHA-256 for the digest itself. If you need confidentiality rather than authenticity, use AES.
How to use the HMAC Generator
- 1 Paste the message you want to authenticate into the message field.
- 2 Enter the shared secret key — this is the value both parties hold.
- 3 Choose the hash function; SHA-256 is the common default for new integrations.
- 4 Copy the hex or Base64 signature and send it alongside the message.
How to Use
Enter your secret key and the message (often a request body or a canonical string), choose the algorithm, and pick hex or base64 output. Results update live.
- Supports SHA-1, SHA-256, SHA-384, and SHA-512
- Hex and base64 output encoding
- Optional key encoding as hex or base64
- Live recomputation as you type
- Nothing is sent over the network
Frequently asked questions
How is HMAC different from a plain hash?
A plain hash of a message can be recomputed by anyone, so it proves nothing about who sent it. HMAC mixes in a secret key, so only someone holding that key can produce a valid signature — that is what makes it an authentication code rather than a checksum.
Why not just hash the secret and the message together?
That construction is vulnerable to length-extension attacks, where an attacker appends data and computes a valid new hash without knowing the key. HMAC’s specific two-pass structure was designed to close exactly that hole.
Where is HMAC used in practice?
Webhook signing (Stripe, GitHub and others sign payloads this way), AWS request signing, and JWT signatures with HS256. In each case the receiver recomputes the HMAC and compares it to detect tampering.
Related Security & Cryptography Tools
You might also need
Tools from other categories that people pair with the HMAC Generator: