HMAC Generator
Free HMAC generator — compute keyed HMAC digests over SHA-256, SHA-512, SHA-3, BLAKE2 and more, in hex or Base64. Runs locally in WebAssembly; your secret key never leaves the page.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Signing a message with HMAC
HMAC answers a different question from a plain hash. A hash tells you whether a message changed; an HMAC tells you whether it changed and whether it came from someone holding the key. That is why webhook providers sign payloads with it — Stripe, GitHub and Slack all send an HMAC-SHA256 header you are expected to recompute and compare.
Comparing tags safely
When you verify an HMAC in your own code, compare it with a constant-time function (crypto.timingSafeEqual in Node, hmac.compare_digest in Python). A plain === returns as soon as two bytes differ, and that timing difference is enough to recover a valid tag one byte at a time.
Verifying this tool
RFC 4231 test case 1: key 0b×20 and message Hi There give HMAC-SHA256 b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7. That key is raw bytes rather than text, so it is not typeable here — but any two systems agreeing on UTF-8 input will agree with this tool.
Frequently asked questions
What is an HMAC?
HMAC (Hash-based Message Authentication Code) combines a secret key with your message and a hash function to produce a tag that proves both integrity and authenticity — anyone holding the same key can recompute it and compare. Unlike a plain hash, an attacker who can change the message cannot recompute a valid tag without the key.
Which algorithm should I use?
HMAC-SHA256 is the modern default and what most APIs expect. SHA-384 and SHA-512 give longer tags and are equally fine. HMAC-MD5 and HMAC-SHA1 are listed for legacy interoperability — HMAC remains sound even on those broken hashes, but new systems should not use them.
Does the encoding of the key matter?
Yes, and it is the most common cause of mismatched tags. Here both message and key are treated as UTF-8 text. If your system holds the key as hex or base64, those are different bytes and will produce a different HMAC — decode it to raw bytes on their side, or paste the decoded text here.
Is my input uploaded?
No. The HMAC is computed locally by a WebAssembly build of the RustCrypto implementation. Nothing leaves the page, and this site has no endpoint that could receive a secret key.