HMAC Generator

Free HMAC generator: create keyed-hash message authentication codes (HMAC) using SHA-256, SHA-1, SHA-384 or SHA-512 with hex or base64 output. Runs in your browser with the Web Crypto API — your secret key never leaves your device.

AI-ready Use this tool with AI

This tool has a free JSON API. Copy a prompt or skill below to use it with ChatGPT, Claude, or any AI agent — no API key needed.

API docs
—
Enter a message and secret key above.

How hmac generator works

HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a code that both verifies data integrity and authenticates the sender. Unlike a plain hash, an HMAC requires the shared secret, so an attacker cannot forge a valid code without the key. HMACs are widely used in API signing (e.g. AWS SigV4, webhooks), message integrity, and session tokens.

This generator uses the Web Crypto API (crypto.subtle) to import your secret key and sign your message with HMAC over SHA-256, SHA-1, SHA-384 or SHA-512. SHA-256 is the standard choice; SHA-1 is provided for legacy compatibility only and should be avoided for new security work. The result can be returned as lowercase hex or base64.

All computation happens in your browser, so your secret key never leaves your device. The same message and key always produce the same HMAC, while any change to either produces a completely different code. Keep your secret key private: anyone who holds it can generate valid HMACs for your messages.

Frequently asked questions

What is HMAC used for?
HMAC verifies that a message has not been tampered with and that it came from someone who knows the shared secret key. It is used in API request signing, webhook payload verification, and integrity-protected tokens.
How is HMAC different from a regular hash?
A plain hash like SHA-256 only depends on the message. HMAC wraps the hash around a secret key, so producing or verifying the code requires the key. This adds authentication on top of integrity.
Which algorithm should I use?
Use HMAC-SHA-256 for new applications. SHA-1 is included for legacy systems only and is not recommended for new security-sensitive work. SHA-384 and SHA-512 offer larger codes when you need extra security margin.
Is my secret key sent anywhere?
No. All signing happens locally in your browser with the built-in Web Crypto API. Your message and secret key never leave your device, so it is safe to use with sensitive keys.

Related tools

Security

Base64 Encoder & Decoder

Encode text to Base64 or decode Base64 back to text instantly.

 Security

Hash Generator

Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly.

 Security

JWT Decoder

Decode JSON Web Tokens and inspect header, payload, and expiry.