HMAC Generator
Generate HMAC authentication codes using SHA-1, SHA-256, SHA-384, or SHA-512.
HMAC Generator β SHA-256/SHA-512 Online Calculator
HMAC Generator computes Hash-based Message Authentication Codes using the Web Crypto API for maximum security and performance.
Enter the message you want to authenticate in the message field and your secret key in the key field. Select your preferred SHA algorithm from the dropdown (SHA-1, SHA-256, SHA-384, or SHA-512). Click Generate to compute the HMAC code, which appears as a hexadecimal string in the output field. The tool uses the Web Crypto API's HMAC implementation, ensuring cryptographic correctness and fast performance. Copy the generated HMAC for use in API authentication headers or data integrity verification. All computation happens locally in your browser.
API developers generate HMAC signatures for webhook payloads so recipients can verify messages originated from the legitimate sender. Backend engineers implement HMAC-based authentication for REST APIs, using this tool to manually test signature generation during development. Security teams verify HMAC implementations by comparing output from production systems against this reference tool. DevOps engineers troubleshoot API integration issues by generating expected HMAC values to compare against what the API receives.
Both sender and receiver must use identical message content, key, and algorithm for verification to succeed; even extra whitespace breaks the match. Use SHA-256 or higher for production systems; SHA-1 is deprecated for security applications. Store secret keys securely and never expose them in client-side code; this tool is for development and testing, not production key handling. When implementing HMAC authentication, include a timestamp in the message to prevent replay attacks where old valid requests get reused maliciously.
All processing happens directly in your browser. Your files never leave your device β no server uploads, no cloud storage, no data retention. The tool works offline once loaded, requires no registration, and is completely free with no usage limits.
Frequently Asked Questions
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a cryptographic construction that uses a secret key and a hash function to produce an authentication code.
Which algorithm should I use?
SHA-256 is the most common choice, offering a good balance of security and performance. Use SHA-512 for maximum security.
Is HMAC the same as hashing?
No. Regular hashing only ensures integrity. HMAC uses a secret key, so it also ensures authenticity β only someone with the key can produce a valid HMAC.
Is this tool secure?
Yes. All computation uses the Web Crypto API and runs entirely in your browser. No data is sent to any server.
Where is HMAC used?
HMAC is used in JWT tokens, API authentication (AWS Signature), webhook verification (GitHub, Stripe), TLS, and many other security protocols.