HMAC Generator
Generate HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 message authentication codes using the Web Crypto API.
Private by architecture:
All processing is 100% client-side memory. Your data never leaves this browser tab.
Message payload
1 line · 28 charsUTF-8
HMAC digests
Selected digest (HMAC-SHA256)
All algorithms
Ready
About This Tool
Computes Hash-based Message Authentication Codes (HMAC) using the browser native Web Crypto API (crypto.subtle.sign). Generates the selected primary digest and displays all four SHA variants (SHA-1, SHA-256, SHA-384, SHA-512) side by side.
Accepts secret keys as UTF-8 text, hexadecimal bytes, or Base64 strings, and formats the resulting MAC as lowercase hex, uppercase hex, Base64, or URL-safe Base64.
Key Features
- Native Web Crypto: Uses crypto.subtle.importKey and crypto.subtle.sign directly in your browser with zero external libraries.
- Four HMAC algorithms: Computes HMAC-SHA256, HMAC-SHA384, HMAC-SHA512, and HMAC-SHA1 simultaneously.
- Flexible key encodings: Provide your secret key as plain UTF-8 text, raw hex bytes, or Base64-encoded binary.
- Multiple output formats: Export digests as lowercase hex, uppercase hex, standard Base64, or URL-safe Base64.
Frequently Asked Questions
When should I use Hex or Base64 key encoding?
Many webhook providers (such as Stripe, GitHub, or AWS) distribute signing keys as hex strings or Base64-encoded byte arrays. Selecting Hex or Base64 decodes the string into raw bytes before importing the HMAC key, rather than hashing the ASCII representation.
Which HMAC algorithm should I pick?
HMAC-SHA256 is the standard choice for modern APIs, webhook signatures, and JWT HS256 tokens. Use HMAC-SHA384 or HMAC-SHA512 when higher security margins are required, and HMAC-SHA1 only for legacy protocol compatibility.
Are my secret key or message sent over the network?
No. All cryptographic operations execute locally inside your browser tab via the Web Crypto API.
