Online Tool Store
HMAC Generator
Compute HMAC-SHA1/256/384/512 signatures from a message and secret key, output in hex or Base64, using the Web Crypto API. Runs entirely in your browser.
🔒 This tool runs entirely in your browser. Your files are never uploaded to a server.
Computed with the Web Crypto API, entirely in your browser — nothing is sent anywhere.
How it works
- Enter your message and secret key.
- Pick a hash algorithm — SHA-256 is the most common default.
- Copy the resulting signature in hex or Base64.
FAQ
What is HMAC actually used for?
It proves a message came from someone who knows a shared secret key, and wasn't altered in transit — common uses include webhook signature verification, API request signing (e.g. AWS), and JWT tokens (the "HS256" family of algorithms).
Is SHA-1 safe to use here?
HMAC-SHA1 is still considered cryptographically sound for message authentication (unlike using raw SHA-1 for things like certificate signing, where it's deprecated) — but SHA-256 or better is recommended for any new system, and it's included as an option mainly for compatibility with existing systems that already use it.
Why does the output change if I edit the message while it's still computing?
Each keystroke starts a fresh computation, and only the most recent one is allowed to update the output — so a burst of fast typing doesn't show a stale result from an earlier, still-finishing calculation.
Is my secret key sent anywhere?
No — the HMAC is computed using your browser's built-in Web Crypto API, entirely locally. Neither the key nor the message ever leaves your device.
How we compare
| Feature | Online Tool Store | Online HMAC generators | Command-line openssl |
|---|---|---|---|
| No file upload — runs in your browser | ✓ | Many send the key to a server | ✓ |
| No terminal needed | ✓ | ✓ | Command-line only |
| No ads | ✓ | Ad-supported | ✓ |
For verifying a webhook signature or testing an API integration, a browser-local calculator is faster than spinning up a terminal for one command — and safer than sending a real secret key to a random website.