RFC 2104 · message authentication · keyed hash

HMAC generator

HMAC (Hash-based Message Authentication Code) combines a secret key with a hash. Used in JWT signing, API auth, and data integrity. Web Crypto API, client-side.

0 chars
0 chars
HMAC
 

How to use this tool

  1. Type or paste the message you want to authenticate into the Message box.
  2. Enter your shared secret in the Secret key box.
  3. Pick an algorithm with the tabs: HMAC-SHA256 (default), HMAC-SHA512, or HMAC-SHA1.
  4. The HMAC appears instantly in the output panel as a hex string, with its byte length shown underneath.
  5. Toggle Uppercase hex if you need capital letters, then hit Copy HMAC to grab the result.
  6. Use Clear all any time to reset both fields and start over.

Why this tool is helpful

Sign API requests

Many APIs (AWS, Stripe, GitHub) sign requests with HMAC. Compute the expected signature here to debug auth failures or build your own signed client.

Verify webhooks

Services send headers like X-Hub-Signature-256. Recompute HMAC-SHA256 over the raw payload to confirm it wasn't tampered with.

Understand JWT & OAuth

HS256 (HMAC-SHA256) is the standard algorithm for signing JWTs and OAuth 1.0 signatures — see exactly what your library produces.

Authenticate a message

HMAC proves a message came from someone who knows the key and that it wasn't altered — integrity and authenticity in one value.

Cross-check your code

Compare your server-side HMAC output against this tool using the same key, message, and algorithm to isolate bugs fast.

Stay private

Computed in your browser with the Web Crypto API. Keys and messages are never uploaded or sent to a server.

FAQ

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function — SHA-1, SHA-256, or SHA-512 — to produce a fixed-size tag that authenticates the message. It's defined in RFC 2104.

How is HMAC different from a plain hash?

A plain hash is unkeyed, so anyone can recompute it. HMAC mixes in a secret key, so only parties that know the key can produce (or verify) the tag. It provides both integrity and authenticity.

Which algorithm should I choose?

SHA-256 is the modern default — it's the standard for JWT (HS256) and webhook signatures. SHA-512 offers a larger output and more security margin. SHA-1 is considered legacy and should be avoided for new systems.

Why is my output empty?

HMAC needs both a message and a key. If either field is blank, the tool won't compute anything. Fill in both and the result appears immediately.

How long is the output?

The hex output is fixed by the algorithm: SHA-256 yields 32 bytes (64 hex chars), SHA-512 64 bytes (128 hex chars), and SHA-1 20 bytes (40 hex chars). The byte count is shown under the result.

Does HMAC encrypt my message?

No. HMAC is a MAC, not encryption — the message stays in plaintext. It only proves the message is authentic and unchanged; pair it with encryption when you need confidentiality too.

Does my key or message leave my browser?

Never. Everything runs locally via the Web Crypto API (crypto.subtle). Your key and message are not sent to, stored on, or logged by any server.