HMAC Generator
Generate HMAC signatures using SHA-256, SHA-512, and other algorithms. Output in hex or base64.
When an HMAC generator is the right tool
Use this page to compute an HMAC of a text message with a shared secret, in the browser. Choose SHA-1, SHA-256, SHA-384, or SHA-512, and hex or Base64 output, then click Generate HMAC. It is not a live hash as you type, and it is not a file-HMAC tool. For an unkeyed digest of text, use Hash Generator; for checksums of a file, use File Hash Generator.
Use cases
Checking a test vector or a webhook signature
Paste the message and the secret (UTF-8 text), keep SHA-256 and hex if that is what the other side uses, and Generate. The well-known vector “The quick brown fox jumps over the lazy dog” with secret key produces the hex digest in the example below.
Switching output encoding
After a successful run, the card is titled HMAC-SHA-256 (hex) or whichever pair you chose. Switching to Base64 clears the result; click Generate again to fill the new encoding. Copy places the digest on the clipboard.
Keeping the secret hidden on screen
The secret field starts as a password input. Reveal it only when you need to check for typos. Whitespace in the secret is significant — leading or trailing spaces change the key bytes.
How the HMAC is computed
Generate imports the UTF-8 secret as a raw HMAC key for the selected hash, signs the UTF-8 message, and formats the bytes as lowercase hex or standard Base64. Empty message or secret fields cannot be submitted. Nothing leaves the browser.
Message: The quick brown fox jumps over the lazy dog
Secret: key
Algorithm: SHA-256
Encoding: hex
HMAC-SHA-256 (hex)
f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
The same digest in base64:
97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=If your expected value differs, check the encoding (hex versus Base64), the hash, and whether the other system treats the key as hex bytes instead of UTF-8 text.
What this tool does not do
It does not compute HMAC-MD5, accept a hex-encoded key, sign a file, or verify a digest against an expected value. Failures are silent (the output is cleared). Nothing is uploaded.
How to use HMAC Generator
- Enter the message and the secret. Optionally reveal the secret to check it.
- Choose an algorithm and hex or base64.
- Click Generate HMAC, then Copy if you need the digest.
Frequently asked questions
Which algorithms and encodings are available?
HMAC with SHA-1, SHA-256 (the default), SHA-384, or SHA-512, via the Web Crypto API. There is no HMAC-MD5. The digest can be shown as lowercase hex (the default) or as standard Base64 (btoa), not base64url. Changing the algorithm or encoding clears the previous output until you generate again.
Does the HMAC update as I type?
No. You have to click Generate HMAC. The button is disabled while the message or the secret is empty, and while a computation is in progress. Editing the message or the secret also clears the output. A failure in Web Crypto is swallowed: the output is cleared and no error text is shown.
How is the secret interpreted? Can I paste a hex key?
Both the message and the secret are encoded as UTF-8 with TextEncoder and passed to crypto.subtle as raw key bytes. There is no hex or Base64 key mode: the characters 00ff are four Unicode code points, not the bytes 0x00 0xFF. The secret field is a password input with a show/hide toggle (hidden by default) and autocomplete off.
Is the secret or the message sent to a server?
No. Signing runs in your browser with the Web Crypto API. The secret is still visible on screen if you reveal it, and it sits in memory while the tab is open. Do not paste a production key if you would not be comfortable with that. Closing the tab discards the form.
Related tools and guides
References
- RFC 2104 defines HMAC. SubtleCrypto.sign with the HMAC algorithm is what this page calls, using SHA-1 or SHA-2 hashes.
- SHA-1 is provided because some existing systems still require it. Prefer SHA-256 or stronger for new work.