security-privacy
HMAC Generator
Generate HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 in your browser from a message and secret, with hex or base64 output.
Tool workspace
The interactive tool requires JavaScript.
Instructions
Choose HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512, then choose hex or base64 output.
Before copying the result, check the API documentation for encoding, newlines, casing, timestamps, and canonical-string order.
Enter a message, a temporary test secret, and an algorithm to calculate a browser-local HMAC. Use it for examples, test vectors, and debugging, not for storing or exposing production secrets.
Direct answer
HMAC Generator uses browser Web Crypto to calculate HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 and returns hex or base64 output. Use test secrets or short-lived debugging secrets only; do not paste production keys, private keys, access tokens, seed phrases, or customer data into an uncontrolled page.
How to use this tool
- Enter the message and a test secret. Avoid production secrets, private keys, access tokens, seed phrases, and customer data.
- Choose HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512, then choose hex or base64 output.
- Before copying the result, check the API documentation for encoding, newlines, casing, timestamps, and canonical-string order.
What HMAC is useful for
HMAC combines a shared secret with a hash function to create a message authentication code. It is commonly used for API signatures, webhook checks, and test vectors. It verifies a message-secret pairing; it does not encrypt or hide the message.
Browser-local processing and secret limits
The calculation runs in the current browser and the tool does not upload or store the message, secret, or result. Browser extensions, clipboard history, screen sharing, device state, and organizational key policy can still matter, so production secrets belong in controlled environments.
Output formats and manual checks
Different APIs may require hex, base64, uppercase, prefixes, line endings, or a specific canonical string. The tool reports the algorithm, output format, and byte counts to help debug encoding differences, but the API documentation and server verification remain the source of truth.
Frequently asked questions
How is HMAC different from a plain hash?
A plain hash depends only on the message. HMAC also uses a shared secret, so another party with the same secret can verify the message. Neither one encrypts the message.
Should I paste a real production secret?
No. The tool is browser-local, but production secrets should be handled only on controlled machines, backends, key-management systems, or approved debugging environments.
Why does my HMAC not match the API example?
Common causes include a different canonical string, whitespace or newline differences, timestamps in the signed value, secret encoding differences, output format differences, or required casing and prefixes.
Can this verify a webhook?
It can generate a manual comparison value, but it does not connect to external services, read request headers, store secrets, or decide whether a request is trustworthy. Production webhook verification belongs on the backend.
Last updated: