Secure HMAC Generator
Compute Keyed-Hash Message Authentication Codes (HMAC) client-side using Web Crypto API.
Input Data
Configuration & Output
What is this tool?
Compute Keyed-Hash Message Authentication Codes (HMAC) client-side for API signatures, token verification, and message integrity using custom secret keys and SHA hashing algorithms.
How to generate an HMAC signature
- Enter your plain text message or payload in the Message field.
- Enter your secret key in the Secret Key field.
- Select your desired algorithm (SHA-256, SHA-384, or SHA-512).
- Choose your preferred output format (Hexadecimal or Base64).
- Copy the generated HMAC authentication digest.
Key Features
- Supports SHA-256, SHA-384, and SHA-512 cryptographic hashing
- Dual output encoding formats: Hex and Base64
- Hardware-accelerated browser Web Crypto API execution (crypto.subtle.sign)
- Instant re-computation upon modifying message, secret, or algorithm
Frequently Asked Questions
What is an HMAC used for?
HMAC is commonly used to authenticate API requests, webhook payloads (e.g., Stripe, GitHub), and JSON Web Tokens (JWT) by verifying that the data has not been modified and originates from a trusted sender holding the secret key.
Is it safe to enter my API secret key here?
Yes. Key derivation and HMAC signing happen strictly in your browser's temporary memory. The secret key is never sent across the network or logged anywhere.
Privacy First
Calculated strictly within your browser using window.crypto.subtle. Secrets and messages are never stored, logged, or uploaded.