HMAC Generator
Enter a message and secret key to instantly compute an HMAC-SHA256, HMAC-SHA1, or HMAC-SHA512 signature.
—
Frequently Asked Questions
What is an HMAC?
A Hash-based Message Authentication Code combines a secret key with a message through a hash function, producing a signature that verifies both the message's integrity and that it was signed by someone who knows the secret.
Is my secret key sent anywhere?
No — the HMAC is computed entirely client-side using the browser's built-in Web Crypto API (crypto.subtle). Neither the message nor the secret ever leaves your device.
Which algorithm should I use?
SHA-256 is the most common choice for HMAC today (used by webhook signature verification in Stripe, GitHub, and many APIs). SHA-1 is legacy and weaker; SHA-512 offers a larger output for higher-security needs.
Explore CodeSpeedTest