What is HMAC Generator
The HMAC Generator creates Hash-based Message Authentication Codes using the Web Crypto API's SubtleCrypto interface. HMAC combines a cryptographic hash function (SHA-256, SHA-384, or SHA-512) with a secret key to produce a fixed-length authentication code that proves both the integrity and the authenticity of a message. Unlike a plain hash, HMAC cannot be computed without the secret key — an attacker who modifies the message cannot forge a valid HMAC without knowing the key.
The tool accepts a message (the data to authenticate) and a secret key, then computes the HMAC using your chosen hash algorithm. The output is a hexadecimal string whose length depends on the underlying hash (64 chars for SHA-256, 96 for SHA-384, 128 for SHA-512). HMAC is defined in RFC 2104 and is the standard mechanism for API request signing, webhook verification, and JWT HS256/HS384/HS512 tokens.
How to Use HMAC Generator
- Enter the message to authenticate in the input panel. This could be a request body, a webhook payload, a string to sign, or any data that needs integrity verification.
- Provide the secret key in the options panel. This is a shared secret known only to the sender and receiver. Use a strong, randomly generated key (at least 32 bytes).
- Select the hash algorithm — SHA-256 is the most common for API signing; SHA-512 is used in higher-security contexts.
- Read the HMAC output — a hex string that the recipient can independently compute using the same key and message to verify integrity.
Why Use HMAC Generator
The most common use case is API request signing. Services like Stripe, GitHub webhooks, and AWS Signature Version 4 require requests to include an HMAC computed over the request body and headers using a secret API key. The server recomputes the HMAC and compares it — if they match, the request is authentic and untampered.
Developers also use HMAC for webhook verification (confirming incoming webhooks are from the expected sender), token generation (JWT HS256 tokens are HMAC-SHA256 over the Base64Url-encoded header and payload), one-time password systems (HOTP uses HMAC-SHA1), and data integrity checks where you need to detect both accidental corruption and intentional modification.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
What is the difference between HMAC and a plain hash?
A plain hash (like SHA-256) is deterministic but not keyed — anyone who knows the algorithm can recompute the hash. HMAC adds a secret key to the computation, so only someone who knows the key can produce a valid HMAC. This means HMAC proves both integrity (the data hasn't changed) and authenticity (the holder of the key produced it). A plain hash proves only integrity.
How long should the secret key be?
For HMAC-SHA256, the key should be at least 256 bits (32 bytes) for full security. Shorter keys reduce the effective security. For HMAC-SHA512, use a 512-bit key. In practice, most API providers generate 32-64 byte random keys. Never reuse the same key across different services or environments.
Can HMAC be used for password hashing?
No. HMAC is designed for message authentication, not password storage. It is fast (which is bad for password hashing — it enables brute-force attacks) and does not include a salt or cost factor. For password hashing, use bcrypt, scrypt, or Argon2. For API authentication and message integrity, HMAC is the correct choice.