Generate HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512 for text or a local file in your browser. Enter the secret key as UTF-8 text or Base64, get hex and Base64 output with copy buttons, and download a summary that never includes the key.
HMAC Generator calculates a keyed-hash message authentication code for a message using your browser’s Web Crypto API. Choose HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512, enter the message as text or choose one local file, and provide the secret key either as UTF-8 text or as Base64 bytes. The result is shown in lowercase hexadecimal and Base64, each with its own Copy button.
Unlike an ordinary hash such as SHA-256, an HMAC depends on a secret key: anyone can compute a checksum, but only someone who knows the key can produce or verify the HMAC. That is why HMACs are used for API request signing and webhook verification. The key is kept only in the page while you work, is never included in copies or the downloadable summary, and is cleared on Reset, when you choose a different file and when you leave the page.
A hash (like SHA-256) depends only on the message, so anyone can calculate it. An HMAC also mixes in a secret key, so it proves the message came from someone who knows the key and was not changed.
Use the format your system uses. Many APIs give a text secret; others give random bytes encoded in Base64. Choosing the wrong format gives a different result.
Check that the algorithm, key format and message are exactly the same, including spaces, line endings and character encoding. Text here is encoded as UTF-8.
No. It is used only in this tab, is never included in copies or downloads, and is cleared on Reset, when you choose a different file and when you leave the page.
Yes, 100 MB. Larger files are refused before they are read, because the browser must load the whole file into memory.
Hex is most common in documentation and logs; Base64 is shorter and common in HTTP headers. Both represent the same bytes.
