HMAC Generator

The HMAC Generator produces keyed-hash message authentication codes for a message plus a secret, letting you verify both the integrity and the authenticity of data in the browser. You supply a message, a secret key — kept behind a password field with a show/hide eye toggle so shoulder-surfing is kept out of the loop — and pick HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 from a dropdown. The output is a hexadecimal signature computed with Web Crypto's HMAC implementation, and it recomputes the instant you change any of the three inputs. Guardrails are explicit: an empty secret triggers Secret is required for HMAC and an empty message triggers Message is empty, so you never receive a signature computed against a wrong key silently. A stat strip reports the algorithm, output bits (256, 384, or 512), and the byte sizes of both the message and the secret. Because the same secret and message always produce the same digest, this tool is ideal for sanity-checking webhook signatures against your server code, verifying API payload integrity, or confirming a third-party implementation matches yours before you wire up real production keys.

1. 1

   Enter the data to authenticate in the Message textarea.

2. 2

   Type the secret into the Secret key field — it is masked, with an eye button to reveal it.

3. 3

   Pick HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 from the Algorithm dropdown.

4. 4

   Read the hex signature in the result box; it recomputes whenever any input changes.

5. 5

   Download the result as hmac-sha256.txt (the filename follows the selected algorithm).

• Verifying webhook signatures against the secret shared with a provider like GitHub or Stripe.
• Confirming a mobile app signed a request with the same key as your API.
• Comparing your backend HMAC implementation against a known-good browser computation.
• Authenticating messages between two internal services during a proof of concept.
• Checking whether a vendor signature used SHA-256 or SHA-512 by testing both algorithms.
• Teaching HMAC concepts with a hands-on example that recomputes instantly.

• Use a secret of at least 32 random bytes in production — the sample secret exists only to demonstrate the tool.
• Verify HMAC signatures with a constant-time comparison function in your real code; visual comparison is only for development.
• Never reuse the same secret across unrelated integrations; rotate secrets regularly.
• Treat the signed message as canonical — signing the same JSON with different key ordering produces a different HMAC.
• Prefer SHA-256 for broad compatibility; use SHA-384 or SHA-512 only where your platform or policy requires longer digests.
• Clear the secret from the field after testing sensitive values, since it stays in browser memory.

• Toggle the eye icon to reveal the secret only when checking typos, then hide it again.
• Use the Message bytes and Secret bytes stats to confirm you copied the exact payload — one hidden space changes the HMAC.
• Test both SHA-256 and SHA-512 when a vendor signature does not match; the wrong algorithm is a common cause.
• Clear both fields with the Clear button before pasting real production secrets, so stale values never mix into a test.