HMAC Generator
Generate a keyed HMAC from a message and a secret, entirely in your browser.
Your data is processed entirely in your browser and is never uploaded.
Tool workspace
Generate an HMAC in three steps
Enter a message
Type or paste the message you want to authenticate: an API request, a payload, a token.
Add the secret key
Enter the shared secret only you and the receiver know. The same key must be used to verify.
Pick & generate
Choose SHA-256 or SHA-512, pick an encoding, then copy the MAC. The key never leaves your browser.
A keyed message authentication code, computed locally
HMAC (Hash-based Message Authentication Code) combines a message with a shared secret key and hashes the result. It proves both integrity and authenticity at once: the message hasn't been tampered with, and whoever produced the MAC knew the key. Because the key is folded into the hash, an attacker who doesn't have it can't forge a matching MAC, something a plain checksum like SHA-256 can never promise. The result is the same size as the underlying hash: 64 hex chars for HMAC-SHA-256, 128 for HMAC-SHA-512. Signing runs entirely in your browser via the native Web Crypto API. The message and key never leave your machine. The key is a shared secret, so guard it like a password: whoever holds it can both sign and verify.
Things to know
Both message and key are required
With either side empty the tool reports empty output. Enter the message to authenticate and the shared secret key, then click Generate.
A different key, a different MAC
The MAC changes completely if the message or the key changes, even by one character. That's the point: it binds the two together so a tampered message is detected instantly.
Not a checksum, not a password hash
A plain checksum has no secret and proves nothing about who made it. HMAC needs a key and proves authenticity. For password storage use a slow, salted function like bcrypt. HMAC is for signing messages, not storing secrets.
Keep the key secret
The key is the security of the scheme. Treat it like a password: never paste real production keys into any online tool, and rotate keys if they might have leaked.
Try these
The quick brown fox jumps over the lazy dog
HMAC-SHA-256 of 'The quick brown fox jumps over the lazy dog' with key 'key', a well-known, verifiable digest.
POST /api/v1/orders
{"customer": "acme", "total": 129.99, "currency": "USD"}Authenticate a typical request body with a shared secret key.
{"event": "payment.succeeded", "order_id": "ord_8f3k2", "amount": 5000, "ts": 1752624000}Sign a webhook payload so the receiver can verify it came from you.
pair this withPlain checksum instead → SHA-256 Hash Generator·Stronger keyed hash → SHA-512 Hash Generator·Hash passwords instead → bcrypt Password Hasher
Where to next
Go deeper
Quick answers
Is my message or key uploaded?
No. The MAC is computed entirely in your browser using the native Web Crypto API. Nothing you enter leaves your machine.
What is HMAC, exactly?
HMAC (Hash-based Message Authentication Code) is a hash computed with a secret key. It proves two things at once: the message hasn't been altered, and whoever produced it knew the key. Unlike a plain checksum, an attacker who doesn't know the key can't forge a matching MAC.
Why do I need a secret key?
The key is what makes the MAC trustworthy. Anyone can compute SHA-256, but only parties who share the secret can produce or verify an HMAC. Keep the key secret. Treat it like a password, and never paste real production keys into any tool.
Which algorithm should I use?
SHA-256 is the common default and matches most APIs and protocols. SHA-512 gives a larger 512-bit MAC and is a good choice for high-security or high-throughput setups. See the SHA-256 vs HMAC comparison.
Is HMAC the same as a hash?
Not quite. A plain hash like SHA-256 has no secret. Anyone can compute it, so it detects accidental corruption but not forgery. HMAC adds a key, so it also proves authenticity. For password storage specifically, use a slow, salted function like bcrypt instead.
Is HMAC encryption?
No. HMAC is authentication, not encryption. It proves integrity and authenticity but does not hide content. See What Is HMAC.
How do I generate HMAC-SHA256 in Python or JavaScript?
Node: crypto.createHmac('sha256', key).update(msg).digest('hex'). Python:hmac.new(key, msg, hashlib.sha256).hexdigest(). See How to Generate an HMAC-SHA-256 Signature.