What is an HMAC and how does it differ from a standard hash?

An HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret pre-shared key. While regular hashes only guarantee data integrity, an HMAC verifies both integrity and authenticity, ensuring the message was created by someone who holds the shared secret.

Are my secret keys and messages sent to any server?

No. All computation executes locally inside your web browser using the native Web Crypto API (crypto.subtle.sign). Your secret keys and payload data never leave your computer.

Which HMAC algorithm should I choose for API signatures?

HMAC-SHA256 is the modern standard for web APIs, webhooks, AWS signatures, and JWT authentication tokens. HMAC-SHA512 provides extra cryptographic margin for highly demanding environments.

HMAC Generator

Compute Keyed-Hash Message Authentication Codes (HMAC) online using SHA-256, SHA-512, SHA-384, or SHA-1. 100% private and client-side.

Client-Side Privacy Free Forever Mobile & PC

100% Client-Side Privacy: HMAC computation runs directly in your browser using the native Web Crypto API. Secret keys and messages are never sent over the network.

Algorithm:

Secret Key (Pre-shared Key)

Message / Payload to Sign43 chars (43 bytes)

Generated HMAC Signature

HMAC-SHA-256

UPPERCASE Hex

Hexadecimal Format

Provide secret key and message above

Base64 Encoded

Provide secret key and message above

Understanding HMAC (Hash-based Message Authentication Code)

HMAC is defined in RFC 2104 and provides cryptographic authentication by binding data to a secret key.

How HMAC Works

HMAC uses a cryptographic hash function (such as SHA-256 or SHA-512) and a shared secret key. The message and key are mixed in two separate hashing passes (inner hash and outer hash) to prevent length extension attacks that affect naive key-prefixing schemes.

Common Applications

HMAC is foundational across software development: API request signatures (AWS S3, Cloudflare, Twilio), Webhook payloads (Stripe, GitHub, Shopify), JSON Web Tokens (JWT HS256/HS512), and secure cookie verification.

Output Formats

Our tool gives you both hexadecimal (standard for hash digests) and Base64 format (popular in HTTP authorization headers and JSON responses).

Our Tool Features

Why developers and engineers prefer this tool for everyday development workflows.

Cross-Device Compatibility

Works seamlessly on all modern desktop, tablet, and mobile browsers including Chrome, Firefox, Safari, Edge on Windows, macOS, Linux, Android, and iOS.

Fast In-Browser Execution

Processes your data in real-time directly inside your browser. No queue wait times, no network round-trips, and zero latency.

100% Client-Side Privacy

Your code, tokens, passwords, and files are never transmitted to any external server or saved in logs. Everything runs locally in memory.

Instant File & Clipboard Input

Supports one-click sample loading, file drag-and-drop, and pasting directly from your clipboard (Ctrl + V) for effortless workflows.

Strict Standards Compliant

Built strictly according to official specifications (RFCs, W3C, ISO, and standard cryptographic algorithms) ensuring accurate output every time.

Unlimited Free Usage

No registration, no accounts, no subscriptions, and no hidden daily quotas. Use this tool as many times as you need without restrictions.

Recent Updates & Improvements

Continuously maintained and improved based on developer feedback.

Client-Side Speed & Performance UpgradeRecent Update

Optimized processing algorithms with Web Workers and native browser APIs (SubtleCrypto, Canvas 2D) for instantaneous zero-latency execution.

Clipboard Paste & Drag-and-Drop AddedFeature Added

Added instant clipboard pasting (Ctrl + V) and drag-and-drop file support to accelerate developer productivity without manual downloads.

Enhanced Mobile & Touch Device ExperienceUI/UX Update

Redesigned responsive touch controls, flexible copy buttons, and camera preview framing for mobile and tablet browsers.

Frequently Asked Questions

Related Tools

JWT Debugger

Decode, verify, and generate JSON Web Tokens in the browser. Check HMAC signatures and inspect claims with 100% privacy.

URL Encoder & Decoder

Encode and decode URLs and query string parameters online with full UTF-8 percent-encoding support.

Text Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes simultaneously in real-time. 100% private, client-side Web Crypto.