About HMAC Generator

HMAC Generator computes a hash-based message authentication code: a hash of your message that also depends on a secret key.

It uses the Web Crypto API in your browser. The key and message stay on this page.

How to use it

  1. Enter the message and the key, and pick their encodings if they are not plain text.
  2. Choose a hash algorithm and an output encoding.
  3. Copy the digest, or paste an expected value to check for a match.

Common questions

What are HMACs for?

They prove a message came from someone who holds the shared key and was not changed on the way. Webhooks and API signatures use them.

Which encodings can the key use?

Plain text, hex, or base64. Pick hex or base64 if your key is a random byte string rather than a passphrase.

Is the comparison timing-safe?

The check compares the whole string rather than stopping at the first difference. That is a reasonable client-side guard, though true timing safety belongs on the server.

Does anything leave my browser?

No. The tool runs entirely on this page.