HMAC Generator

What is HMAC Generator?

The HMAC Generator is a free online tool that computes a keyed hash message authentication code (HMAC) from any text message and a shared secret key. It supports SHA-1, SHA-256, SHA-384 and SHA-512 through the Web Crypto API plus the SHA-3 family — SHA3-224, SHA3-256, SHA3-384 and SHA3-512 — and outputs the signature as hexadecimal (lowercase or uppercase) or Base64. You can interpret the secret key as UTF-8 text, hex, or Base64 bytes, and switch to verify mode by pasting an expected HMAC, which is checked with a constant-time comparison to resist timing attacks. Developers use it to sign webhook payloads, build and verify API request signatures, generate tamper-evident tokens, or confirm that a value matches a signature from another system. The signature recomputes live as you edit any field and runs entirely in the browser. Common searches include "hmac sha256 generator", "hmac sha3", "hmac base64", and "hmac verify online".

How to use HMAC Generator

1. Type or paste the message you want to sign into the Input box.
2. Enter your shared secret key, and in Options choose whether it is UTF-8, hex, or Base64.
3. Pick the hash algorithm — SHA-1, SHA-256, SHA-384, SHA-512, or a SHA-3 variant — from the dropdown.
4. Switch the output between Hex and Base64, and toggle uppercase hex in Options if you need it.
5. Read the HMAC as it updates automatically, then click Copy — or paste an expected HMAC into the verification field to check for a match.

Examples

message: The quick brown fox
key: secret
algorithm: SHA-256
encoding: Hex

7a284e5025f32a846fa3e6957d10278eb5726dd4e0b04c8e0259defcd2cd0eb1

message: The quick brown fox
key: secret
algorithm: SHA-256
encoding: Base64

eihOUCXzKoRvo+aVfRAnjrVybdTgsEyOAlne/NLNDrE=

Frequently asked questions

Which hash algorithms and encodings are supported?

SHA-1, SHA-256, SHA-384 and SHA-512 (via the Web Crypto API) and the SHA-3 family (SHA3-224, SHA3-256, SHA3-384, SHA3-512). The signature is shown as hexadecimal — lowercase or uppercase — or as Base64, and the secret key can be read as UTF-8, hex, or Base64.

Are my message and secret key uploaded anywhere?

No. The HMAC is computed 100% client-side: SHA-2 with the Web Crypto API and SHA-3 with in-browser WebAssembly. Neither the message nor the secret key is ever sent to a server, so it is safe to use with real keys.

How does verify mode work?

Paste the value you expect into the verification field. The tool compares it to the freshly computed HMAC with a constant-time algorithm that never exits early, so the comparison time does not reveal where a mismatch occurs. Hexadecimal is matched case-insensitively.

How is the secret key treated?

By default the key is UTF-8 text, but you can switch it to hex or Base64 in Options so binary keys are decoded exactly. The key field is a password input — masked on screen and excluded from saved workspace state — and it is used only in your browser.

Why does my HMAC differ from another tool's?

An HMAC depends exactly on the message bytes, the key bytes, and the chosen hash. Trailing whitespace, a different algorithm, hex versus Base64, uppercase versus lowercase hex, or a different key encoding will all change the result.