Skip to content
🔑

HMAC Generator

Keyed hashes with Web Crypto in your browser. Text or file input, verify an expected tag.

HMAC gives you integrity and authenticity, not encryption. Anyone with the key can produce the tag; anyone without it cannot forge one for a modified message. The tag does not hide the message.

All four run through crypto.subtle.importKey('hmac') on your device.

Tag output

Hex

—

Base64

—

Verify a supplied tag

The compare walks both byte strings byte by byte and keeps a running XOR, so timing does not leak the first mismatched position. It is still not a cryptographic verification primitive — treat a “match” as advisory.

Self-check example

Key secret and message hello world under HMAC-SHA-256 must always produce:

734cc62f32841568f45715aeb9f4d7891324e6d948e4c6c60c0621cdac48623a

More in Security Tools

View all →
Password Strength Checker Test password strength & crack time Suspicious Link Checker Expand short links & spot phishing Hash Identifier Identify MD5, SHA, bcrypt & more Credit Card Validator Luhn check & brand detection File Checksum Verifier SHA checksums for any file Secure Token Generator API keys, hex & UUID tokens

What Is HMAC Generator?

The HMAC Generator signs a message with a shared secret using SHA-1, SHA-256, SHA-384 or SHA-512 through Web Crypto, entirely on your device. Paste text or read a file into an ArrayBuffer, and the page shows the tag in hex and base64 side by side, plus a byte count. A constant-time comparison mode lets you paste an expected tag and see a match verdict without timing the first mismatched byte. A published SHA-256 example pair lets you sanity-check your inputs against what any other conforming library should return.

Who Uses the HMAC Generator?

Backend developers signing webhooks, students following RFC 2104, and API testers who want to see the exact byte string a client produced without shipping their key to a server.

How to Use the HMAC Generator

  1. Type or paste the shared key, switch between raw text and Base64, and pick the algorithm.
  2. Enter the message body, or choose Read a file and load it as an ArrayBuffer.
  3. Copy the hex or base64 tag, or paste an expected tag into the verify box and press Compare.

Why Choose Our HMAC Generator?

  • Four SHA-family algorithms through crypto.subtle, nothing uploaded
  • File signing with byte count so you can match a server-side digest
  • Constant-time compare plus a self-check example you can reproduce

Try the HMAC Generator above — it is free, fast, and works on any device. Bookmark this page to return whenever you need it.