HMAC Generator
Compute keyed HMAC signatures with SHA-256, SHA-384 or SHA-512. Pure Web Crypto, no key ever leaves your browser.
Signature appears here
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a message authentication code. Unlike a plain hash, an HMAC proves both that a message has not been tampered with and that the sender knew the secret key — providing authentication as well as integrity.
HMAC is used in API request signing (AWS Signature Version 4, Stripe webhooks), JWT signature verification, and secure cookie signing.
How to generate an HMAC online
- Enter your secret key in the Key field.
- Paste your message into the Message field.
- Choose the hash algorithm: HMAC-SHA-256 or HMAC-SHA-512.
- The HMAC digest appears instantly in the Output panel.
Frequently Asked Questions
What is the difference between HMAC and a plain hash?
A plain hash only verifies data integrity — anyone can compute it. HMAC adds a secret key, so only parties who know the key can generate or verify the HMAC. This prevents an attacker from tampering with data and regenerating a valid hash.
What is HMAC-SHA-256?
HMAC-SHA-256 is HMAC computed with SHA-256 as the underlying hash function. It produces a 64-character hexadecimal digest and is the most widely used HMAC variant in web APIs.
Is HMAC the same as a digital signature?
No. HMAC uses a symmetric key — the same key is used to generate and verify. Digital signatures use asymmetric keys (a private key to sign, a public key to verify). Both provide authentication, but digital signatures additionally provide non-repudiation.
Where is HMAC used in practice?
HMAC is used in: AWS API request signing, Stripe and GitHub webhook verification, OAuth 1.0 request signing, session cookie signing, and as part of JWT HS256/HS512 token signing.