HMAC Generator (SHA-256, SHA-1, SHA-512)
Generate an HMAC of any message with a secret key using SHA-256, SHA-1, or SHA-512 — output as hex, running 100% in your browser with nothing uploaded.
🔒 Your message and key are processed in your browser — nothing is uploaded.
What is an HMAC?
HMAC (Hash-based Message Authentication Code) combines a secret key with a cryptographic hash function to produce a fixed-length code that proves both the integrity and the authenticity of a message. Unlike a plain hash, an HMAC can only be reproduced by someone who knows the secret key, so it is widely used to sign API requests, verify webhooks, protect cookies, and secure tokens. This tool uses the browser's built-in Web Crypto API, encoding your message as UTF-8 and returning the result as lowercase hexadecimal. If your secret key is not plain text, switch the Key format to Hex or Base64 so binary keys — common with API signing schemes like AWS, Azure Shared Key, or JWT HS256 — are decoded to the exact same bytes the server uses.
Choosing an algorithm
SHA-256 is the modern default and a solid choice for almost everything, producing a 64-character hex code. SHA-512 offers a longer 128-character output and is common in high-security contexts. SHA-1 is provided for compatibility with older systems and legacy webhook signatures, but it is considered weak and should not be used for new designs. Pick the algorithm your API or partner service expects, paste in the exact same secret key they use, and the HMAC here will match theirs byte for byte.
Frequently asked questions
What is the difference between an HMAC and a plain hash?
A plain hash (like SHA-256 on its own) depends only on the message, so anyone can compute it. An HMAC also mixes in a secret key, so only parties who share that key can generate or verify the same code — that is what makes it useful for authentication.
Is my message or secret key uploaded to a server?
No. The HMAC is computed entirely in your browser using the Web Crypto API. Your message and key never leave your device — nothing is sent to or stored on any server.
Which algorithm should I choose?
Use SHA-256 unless a system you are integrating with requires something else. Choose SHA-512 for longer output in high-security settings, and only use SHA-1 when you must match a legacy system, since SHA-1 is no longer recommended.
My secret key is in hex or Base64 — how do I use it?
Set the Key format selector to Hex or Base64. Many API signing secrets are random bytes distributed as hex or Base64 rather than readable text, and decoding the key correctly is essential: the same characters interpreted as UTF-8 versus hex produce completely different HMACs.