HMAC Generator
Calculate the HMAC (Hash-based Message Authentication Code) of a message using a secret key, with your choice of hash algorithm. The calculation is done locally via your browser’s WebCrypto API: neither the message nor the secret key ever leaves your device.
How it works
An HMAC combines a message and a secret key through a hash function to produce a fingerprint that proves both the integrity of the message and possession of the key. It’s the mechanism used, for example, to sign API requests (AWS Signature, Stripe/GitHub webhooks) or to sign JWTs in HS256 mode. Enter the message, secret key, and desired algorithm: the result is displayed in hex and base64, the two most commonly expected formats.
What’s the difference between a simple hash and an HMAC?
A simple hash (e.g., SHA-256 of a text) depends only on the message: anyone can recompute it. An HMAC also depends on a shared secret key: only someone who knows the key can produce or verify the same value, which guarantees both the integrity and the authenticity of the message’s origin.
Which algorithm should I choose?
SHA-256 is the most common choice today and fits the vast majority of use cases (webhooks, API signatures). SHA-384 and SHA-512 offer a longer fingerprint for stronger security requirements. SHA-1 is still found for compatibility with older systems, but is no longer recommended for new uses.
Privacy: the calculation is performed 100% locally via your browser’s native WebCrypto API—your message and secret key are never transmitted to a server.