Toolstia / HMAC generator
HMAC generator
Enter a secret key and a message to compute their HMAC. Choose SHA-256, SHA-512, SHA-384 or SHA-1 and get the signature in hex and Base64. It is calculated in your browser and nothing is uploaded.
Computed in your browser with the Web Crypto API. The key and message are never uploaded. Text is encoded as UTF-8.
How it works
- Choose the algorithm.
- Enter the secret key and the message.
- Copy the hex or Base64 signature.
What an HMAC is
A keyed hash that proves a message came from someone who knows the secret key and was not changed. Webhooks and API signatures commonly use HMAC-SHA256.
Encoding
The key and message are encoded as UTF-8 text before hashing. The output is shown as lowercase hex and as Base64.
Tested values
The tool matches the standard test vectors, for example key "Jefe" and message "what do ya want for nothing?" gives 5bdcc146...ec3843 with SHA-256.
SHA-1
HMAC-SHA1 is still considered safe for message authentication but is mainly kept for compatibility. Prefer SHA-256 or stronger.
Questions
Is my key uploaded?
No. It is used only in your browser.
What is the difference between a hash and an HMAC?
An HMAC needs a secret key, so only someone with the key can produce or check it.
Is anything uploaded?
No. Everything is done in your browser and nothing is sent anywhere.