HMAC Generator help

HMAC Generator computes a hash-based message authentication code: a hash of your message that also depends on a secret key.

Steps

  1. Enter the message and the key, and pick their encodings if they are not plain text.
  2. Choose a hash algorithm and an output encoding.
  3. Copy the digest, or paste an expected value to check for a match.

Common questions

What are HMACs for?

They prove a message came from someone who holds the shared key and was not changed on the way. Webhooks and API signatures use them.

Which encodings can the key use?

Plain text, hex, or base64. Pick hex or base64 if your key is a random byte string rather than a passphrase.

Is the comparison timing-safe?

The check compares the whole string rather than stopping at the first difference. That is a reasonable client-side guard, though true timing safety belongs on the server.

Does anything leave my browser?

No. The tool runs entirely on this page.

Everything runs in your browser. Nothing you enter or drop is uploaded.

Back to HMAC Generator