HMAC Generator — SHA-256, SHA-1, SHA-512 (Free, In-Browser)

Q: How do I generate an HMAC-SHA256?

Type your message and secret key with HMAC-SHA256 selected. The hex digest appears instantly; switch to Base64 with the output dropdown if your system expects it.

Compute an HMAC (hash-based message authentication code) from a message and a secret key. Choose the hash algorithm and hex or Base64 output. Everything runs in your browser using the native Web Crypto API — your key and message are never sent anywhere.

What an HMAC is

An HMAC proves two things at once: that a message hasn't been tampered with, and that whoever produced the code knows a shared secret key. It runs a hash function (SHA-256, SHA-1, …) over the message combined with the key in a specific way. Anyone with the same key and message gets the same code; anyone without the key can't forge it, even though the hash algorithm itself is public.

HMAC vs a plain hash

A bare SHA-256(message) only detects accidental changes — anyone can recompute it, so it proves nothing about who made it. HMAC mixes in a secret key, so the code also authenticates the sender. That's why webhooks (Stripe, GitHub, Slack) sign their payloads with HMAC: you recompute the HMAC with your shared secret and compare it to the header to confirm the request is genuine.

Gotchas worth knowing

Same key, same message, same algorithm → identical output, every time. If your code doesn't match a server's, the usual culprits are a trailing newline in the message, the wrong encoding, or hex-vs-Base64 mismatch.
Compare in constant time on a server. When verifying a signature in real code, use a constant-time comparison (e.g. hmac.compare_digest) to avoid timing attacks — a plain == can leak information.
HMAC-SHA1 is still safe for HMAC. SHA-1 is broken for collisions, but HMAC's construction doesn't rely on collision resistance, so HMAC-SHA1 remains acceptable — though SHA-256 is the sensible default for new work.
This is a signature, not encryption. HMAC doesn't hide the message; it only authenticates it. The message stays readable.

Frequently asked questions

How do I generate an HMAC-SHA256?

Type your message and secret key above with HMAC-SHA256 selected. The hex digest appears instantly — switch to Base64 with the output dropdown if your system expects it.

Is my key sent to a server?

No. The HMAC is computed locally with your browser's built-in Web Crypto API. Nothing you type leaves the page.

Why doesn't my HMAC match the server's?

Almost always an input difference: a trailing newline, a different character encoding, or comparing a hex digest against a Base64 one. Make the message bytes and output format match exactly.

Need other developer utilities? Browse all tools on the home page.