HMAC Generator

HMAC (Hash-based Message Authentication Code) is a keyed cryptographic checksum. It combines a shared secret key with a cryptographic hash function (SHA-256, SHA-384, or SHA-512) to produce a signature for a message. Anyone with the same secret can recompute the HMAC and compare it: if the signatures match, the message is genuine and unchanged. If an attacker does not know the secret, they cannot forge a valid HMAC for their own message.

A plain hash (like SHA-256) can be computed by anyone for any input — it only proves data integrity, not authenticity. An HMAC requires a secret key, so it also proves the sender knew that key. This makes HMAC suitable for authenticating API requests, verifying webhooks, signing tokens, and protecting messages in transit where a plain hash could be trivially recalculated by an attacker.

Encryption hides the content of a message but does not by itself prove it was not modified in transit. HMAC is the standard way to add authenticity and integrity on top of (or instead of) encryption. In practice the two are combined: encrypt for confidentiality, and attach an HMAC so the receiver can verify the data came from the expected party unchanged. This tool generates the HMAC half of that pattern.

HMAC-SHA256 is the default choice for most applications — it is fast, hardware-accelerated, and accepted everywhere. HMAC-SHA384 and HMAC-SHA512 produce longer signatures (48 and 64 bytes respectively) and are worth choosing when a longer tag is required by policy. All three are members of the SHA-2 family and remain secure for keyed authentication.

The secret must be shared out-of-band between the sender and receiver and must never travel with the message or the signature. The HMAC is only as secure as this secret — a weak or leaked key lets an attacker forge signatures. Use a long, random key (this site's Secure Random or Password Generator can create one), rotate it periodically, and never store it in code that gets committed.

Yes. The message, secret, and signature never leave your browser — all computation runs with the Web Crypto API. This is safe even when authenticating sensitive payloads, and the tool works fully offline after the page loads.

Yes — completely free, no registration, and 100% private. HMAC generation runs locally in your browser using the Web Crypto API; nothing is sent to any server, and the tool works offline after the page loads.