🔐 HMAC Generator

About the HMAC Generator

HMAC (Hash-based Message Authentication Code) is a technique for verifying both the integrity and authenticity of a message. It combines a cryptographic hash function with a secret key, producing a digest that only someone holding the same key can reproduce. This tool generates HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 simultaneously, all computed locally in your browser via the Web Crypto API — nothing is uploaded.

How it works

• Keyed hashing — HMAC mixes the secret key into the message in a specific way (inner and outer pads) so that the digest depends on both the message and the key.
• Formula — HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m)), where K' is the key padded/hashed to the block size, ipad is 0x36 repeated, and opad is 0x5C repeated.
• Verification — The receiver recomputes HMAC over the message with the shared key and compares it to the received digest. A mismatch signals tampering or a wrong key.
• The Web Crypto API (crypto.subtle.importKey and crypto.subtle.sign) performs the actual computation natively and securely.

Use cases

• API request signing — Many web APIs (AWS, GitHub webhooks, Stripe) require HMAC signatures to verify that requests originate from an authenticated party.
• Webhook verification — Verify the X-Hub-Signature-256 header to confirm a webhook payload was sent by the claimed service.
• Token derivation — HMAC is the basis for HOTP/TOTP one-time passwords and JWT signature algorithms (HS256, HS384, HS512).
• Integrity checks — Detect tampering when both parties share a secret, where a plain hash is insufficient.

Frequently asked questions

What is the difference between a hash and an HMAC? A plain hash has no key — anyone can compute it. An HMAC requires a secret key, so it proves both data integrity and authenticity (the sender knows the key).

Which algorithm should I use? For new applications, prefer HMAC-SHA256 or HMAC-SHA512. HMAC-SHA1 is still common in legacy systems (e.g., HOTP) but is no longer recommended for new security-sensitive uses.

Is my secret key sent anywhere? No. Both the message and the key are processed locally in your browser through the Web Crypto API. Nothing is uploaded.

How long should my secret key be? At least as long as the hash output size is a good rule of thumb (e.g., 256 bits / 32 bytes for SHA-256). Avoid keys shorter than 128 bits.