HMAC Generator — SHA-1, SHA-256, SHA-384 & SHA-512
Generate an HMAC for any message and secret key using SHA-1, SHA-256, SHA-384 or SHA-512. Output in hex or Base64 — computed entirely in your browser.
🔒 Runs entirely in your browser. Your input and output are never sent to a server or stored — fully private.
Computed in your browser with the Web Crypto API — nothing is sent anywhere.
About this tool
Compute an HMAC — a keyed hash — for any message and secret key, choosing SHA-1, SHA-256, SHA-384 or SHA-512 and reading the result as hex or Base64. HMACs are how APIs sign webhooks and confirm that a request truly came from someone holding the shared key. The signature is calculated with the browser's built-in Web Crypto API, so the message and key you enter never leave your device — handy for testing webhook signatures and API authentication.
Frequently asked questions
What is an HMAC and when would I use one?
An HMAC, or hash-based message authentication code, mixes a message with a secret key to produce a signature. Anyone who holds the same key can recompute that signature and confirm the message was not altered and came from a trusted sender. It is widely used to sign API requests, validate incoming webhooks from services like Stripe or GitHub, and protect tokens against tampering.
Can I get the original message back from an HMAC?
No. An HMAC is a one-way hash, not encryption, so there is no way to reverse it back into the original message. You also cannot compute or verify one without the secret key, and that key is exactly what makes the signature trustworthy. To check an HMAC you recompute it from the same message and key, then compare the two values for an exact match.
Are my message and key sent to a server?
No. The HMAC is calculated entirely in your browser with the Web Crypto API, so the message you type and the secret key you enter are never uploaded, logged or stored. That makes it safe to experiment with real signing keys here, though as a general habit you should still avoid entering production secrets on any shared or public computer.