HMAC Generator
Compute HMAC-SHA1, SHA-256, SHA-384, and SHA-512 authentication tags from a message and a shared secret — all in your browser.
32-byte authentication tag.
HMAC is computed locally with the browser's SubtleCrypto API. Your key and message never leave your device.
Four hash algorithms
HMAC-SHA1, SHA-256, SHA-384, and SHA-512 — switch instantly to match the API or webhook you're integrating with.
Flexible key input
Enter the secret as text, hex, or Base64 — matching the formats used by AWS, GitHub, Stripe, and most webhook providers.
Private by default
All HMAC computation runs in your browser via SubtleCrypto. Keys and messages never leave your device.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a construction defined in RFC 2104 that turns any cryptographic hash function into a keyed message authenticator. By mixing a shared secret into the hash computation, HMAC guarantees both that a message hasn't been altered and that it was produced by someone holding the key — properties a plain hash alone cannot provide.
Common HMAC use cases
HMAC is everywhere: API request signing (AWS Signature Version 4, Shopify, Twilio), webhook verification (GitHub, Stripe, Slack all sign payloads with HMAC-SHA256), JWTs (the HS256/HS384/HS512 algorithms are HMAC under the hood), session cookies, and as a building block inside TLS, IPsec, and SSH.
Verifying webhook signatures
When a service sends you a webhook, it usually includes an HMAC of the request body in a header like X-Signature. Use this tool to recompute the HMAC with your endpoint's signing secret and compare against the received value. If they match, the request really came from the service and wasn't tampered with in transit.
Choosing the right algorithm
HMAC-SHA256 is the modern default and what you should reach for unless an integration requires something else. HMAC-SHA384/SHA512 give a larger security margin and are common in high-security or government contexts. HMAC-SHA1 remains cryptographically sound for authentication but is being phased out — only use it when interoperating with legacy systems.
Frequently asked questions
›What is HMAC?
HMAC (Hash-based Message Authentication Code) is a way to verify both the integrity and authenticity of a message using a shared secret key and a cryptographic hash function. It's defined in RFC 2104 and is one of the most widely used MAC constructions on the internet.
›How is HMAC different from a plain hash?
A plain hash (like SHA-256) only proves a message hasn't changed — but anyone can compute it. HMAC mixes in a secret key, so only parties holding the key can produce or verify a valid tag. Without the key, an attacker can't forge an HMAC even if they see many examples.
›What is HMAC used for?
API request signing (AWS SigV4, Stripe, GitHub webhooks), JWT signatures (HS256/HS384/HS512), session cookies, CSRF tokens, and message authentication in TLS and IPsec.
›Which HMAC algorithm should I use?
HMAC-SHA256 is the modern default and is widely supported. Use HMAC-SHA384 or HMAC-SHA512 for higher security margins. HMAC-SHA1 is still secure for authentication (HMAC is resilient to the SHA-1 collision attacks) but is being deprecated for new systems.
›How long should the secret key be?
RFC 2104 recommends a key at least as long as the hash output: 32 bytes for HMAC-SHA256, 48 for SHA-384, 64 for SHA-512. Shorter keys still work but provide less security. Keys longer than the hash block size are pre-hashed.
›How do I verify an HMAC?
Recompute the HMAC over the received message using the shared secret, then compare with the received tag using a constant-time comparison to prevent timing attacks. Most languages have a dedicated helper (e.g. crypto.timingSafeEqual in Node.js).
›What encoding should I use for the key?
Use UTF-8 text when your key is a passphrase or copy-paste string. Use hex or Base64 when your key is a random byte string — that's the format AWS, GitHub, and most webhook providers use.
›Is HMAC-SHA1 still safe?
Yes, for authentication. The SHA-1 collision attacks (SHAttered) don't break HMAC-SHA1 because HMAC's nested construction is much stronger than the raw hash. That said, new systems should prefer HMAC-SHA256 for forward compatibility.
›Can HMAC encrypt my message?
No. HMAC only authenticates; it does not encrypt. The message remains visible to anyone who intercepts it. For confidentiality plus authenticity, use an authenticated encryption mode like AES-GCM or ChaCha20-Poly1305.
›Is my key or message uploaded?
No. HMAC is computed entirely in your browser using the native SubtleCrypto API. Your secret key and message never leave your device.
More free developer tools
Part of our growing tool belt — all client-side, all free.
MD5, SHA-1 & SHA-256 Hash Generator
Generate cryptographic hashes from text, locally and instantly.
Open toolSHA-256 Hash Generator
Generate SHA-256 hashes from text or files — hex, Base64, and Base64URL output, all in your browser.
Open toolSHA-512 Hash Generator
Generate SHA-512 hashes from text or files — hex, Base64, and Base64URL output, all in your browser.
Open tool