HMAC Generator
Authenticate a message with a shared secret key using a standard HMAC algorithm. Your message and key stay in the browser.
UTF-8 text, up to 1 MiB. Processing happens locally in your browser.
Keep this key private. Maximum 4,096 characters.
Enter a message and secret key to begin.
A QUICK WALKTHROUGH
How to use this tool
- Enter the message and shared secret key.
- Choose HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512.
- Generate the lowercase hexadecimal signature and copy it when ready.
Standard HMAC algorithms
The tool uses the browser’s Web Crypto SubtleCrypto sign operation with HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512. Results are lowercase hexadecimal strings.
Local processing and clear limits
The message is limited to 1 MiB and the secret key to 4,096 bytes so the operation remains practical in a browser. Inputs and results are processed locally and are not uploaded or stored by this tool.
Signing is not encryption
An HMAC verifies integrity and authenticity when both parties share the secret key. It does not hide the message, and the key must remain confidential.
GOOD TO KNOW
Common questions
Which HMAC algorithms are available?
You can generate HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 signatures.
Is my key uploaded?
No. The Web Crypto operation runs locally in your browser, and this page does not send or store your inputs.
Does whitespace affect the signature?
Yes. Every character, including spaces and line breaks, is encoded as UTF-8 and affects the HMAC.
Is HMAC encryption?
No. HMAC authenticates data and detects changes. Use authenticated encryption when you need confidentiality as well.