Free Online HMAC Generator
Generate HMAC-SHA256 and HMAC-SHA512 hash-based message authentication codes from text and a secret key. All processing runs locally in your browser.
Key Features
Cryptographically Secure
Uses the native Web Crypto API with cryptographically secure HMAC signing — no external libraries required.
Two Algorithms
Choose between HMAC-SHA256 and HMAC-SHA512 to match your API or application requirements.
Hex & Base64
Output HMAC in either hex or Base64 encoding — both commonly used in API authentication headers.
100% Private
Your secret key and message never leave your browser. All computation runs entirely client-side.
Frequently Asked Questions
Basics
What is HMAC and how does it differ from a regular hash?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key. Unlike a plain hash (like SHA-256 of a message), only someone who knows the secret key can generate or verify the HMAC. This makes HMAC suitable for API request signing, message integrity verification, and authentication.
How do I use this HMAC generator?
- Enter your secret key in the Secret Key field.
- Type or paste the message you want to sign.
- Select the algorithm (SHA-256 or SHA-512) and output format (Hex or Base64).
- Click Generate HMAC to compute the result.
- Use the Copy button to copy the HMAC value to your clipboard.
Example
Secret Key:
my-secret-key
Message:
Hello, World!
HMAC-SHA256 (Hex):
5ccec1ce96ea3b58b1d6c6ffd2ac1b8c0ea74fab8d5fb27f133cbe34a4d8b821
Details
What is the difference between HMAC-SHA256 and HMAC-SHA512?
HMAC-SHA256 produces a 256-bit (32-byte) output while HMAC-SHA512 produces a 512-bit (64-byte) output. SHA-512 is more computationally expensive but offers a larger security margin. Most modern APIs use HMAC-SHA256 as a good balance of security and performance.
Should I use hex or Base64 format for my HMAC?
Both are widely used. Hex encoding produces a longer string (64 characters for HMAC-SHA256 vs 44 for Base64) but is easier to read and debug. Base64 is more compact and commonly used in HTTP headers like the Authorization header. Choose the format that matches your API specification.
Why use HMAC instead of simply hashing a message with the secret key appended?
Naive concatenation (hash(secret + message)) is vulnerable to length extension attacks for MD5, SHA-1, and SHA-2 families. HMAC uses a specific construction (two rounds of hashing with the key XORed with ipad/opad) that prevents these attacks. Always prefer HMAC over custom hash-and-key schemes.
Can I use this tool for production API authentication?
Yes, the HMAC generated here follows the same algorithm as your backend. Use it during development to verify that your server-side HMAC implementation produces the correct result. For production, always compute HMACs server-side where the secret key stays protected.
What if I need a key longer than the block size?
The Web Crypto API handles this automatically according to RFC 2104: if the key is longer than the block size (64 bytes for SHA-256, 128 bytes for SHA-512), it is first hashed down to the appropriate length. You do not need to pre-process the key — just paste it as-is.