HMAC Generator
Enter a message and secret key to instantly compute an HMAC-SHA256, HMAC-SHA1, or HMAC-SHA512 signature.
—
Frequently Asked Questions
What is an HMAC?
A Hash-based Message Authentication Code combines a secret key with a message through a hash function, producing a signature that verifies both the message's integrity and that it was signed by someone who knows the secret.
Is my secret key sent anywhere?
No — the HMAC is computed entirely client-side using the browser's built-in Web Crypto API (crypto.subtle). Neither the message nor the secret ever leaves your device.
Which algorithm should I use?
SHA-256 is the most common choice for HMAC today (used by webhook signature verification in Stripe, GitHub, and many APIs). SHA-1 is legacy and weaker; SHA-512 offers a larger output for higher-security needs.
Related free utility tools
- Click CounterType any number, get that many clickable numbered boxes, and tap each as you count. Progress and notes save in your browser.
- SHA-256 Hash GeneratorGenerate a SHA-256 hash from any text instantly, entirely in your browser — nothing is ever uploaded.
- SHA-512 Hash GeneratorGenerate a SHA-512 hash from any text instantly, entirely in your browser — nothing is ever uploaded.
- MD5 Hash GeneratorGenerate an MD5 checksum from any text instantly — useful for legacy systems, computed entirely client-side.
- Password GeneratorGenerate strong, random passwords with a custom length and character set using a cryptographically secure source.
- Password Strength CheckerCheck how strong a password is with a live score and specific tips to improve it — nothing is ever transmitted.
Explore CodeSpeedTest