Encoders / Escapers / Crypto

HMAC Generator

Create an HMAC with a secret key and chosen algorithm.

Message

Secret key

HMAC

Guide & explanation

An HMAC (Hash-based Message Authentication Code, RFC 2104) combines a message with a secret key to produce a code that proves the message is authentic and unchanged.

HMAC versus a plain hash

A plain hash (SHA-256) can be computed by anyone, so it does not prove who sent the message. An HMAC can only be produced and verified by parties that hold the same key.

Typical uses

Signing and verifying webhooks (e.g. an X-Signature header).
Signed tokens such as the signature part of a HS256 JWT.
Checking message integrity between services.

Options

Algorithm — SHA-1, SHA-256, SHA-384, or SHA-512.
Output — hex or Base64.

The computation uses Web Crypto; the key and message never leave the browser.