HMAC Generator
HMAC Generator authenticates pasted text with a supplied secret key using HMAC-SHA-256, HMAC-SHA-384, or HMAC-SHA-512 through Web Crypto. The output can detect changes for parties sharing the key; it neither encrypts the message nor proves who controlled the browser. Real production keys should remain in managed key storage rather than general-purpose text fields.
Runs locally — files stay on your deviceWhat does HMAC provide?
Message authentication and integrity for parties that share the secret key; it does not hide the message.
HMAC combines a cryptographic hash with a secret key
HMAC applies a standardized inner and outer keyed construction around a hash. Verification recomputes the tag with the same key and compares it safely.
How it works
Enter message text, secret key, and SHA-2 variant. Both strings are encoded as UTF-8, Web Crypto signs the message with HMAC, and the resulting bytes are rendered as lowercase hexadecimal.
Key concepts
Both sides need the same secret
Anyone with the key can create a valid tag.
Exact bytes determine the result
Encoding, whitespace, line endings, and case all matter.
When to use it
- Reproduce a test-vector tag.
- Debug a UTF-8 HMAC integration.
- Demonstrate keyed integrity.
When not to use it
- Do not paste production signing keys.
- Do not use HMAC to encrypt content.
- Do not compare authentication tags with timing-leaky application code.
Worked examples
Stable test
- Input
Same message, key, and algorithm twice- Expected output
Same hex tag
HMAC is deterministic.
Message change
- Input
Change one character- Expected output
Different tag
Authentication is byte-sensitive.
Algorithm change
- Input
SHA-256 versus SHA-512- Expected output
Different lengths and values
Algorithms are not interchangeable.
Common mistakes
Treating the key as a password
Low-entropy keys can be guessed. Correction: Use cryptographically generated key material.
Calling HMAC encryption
The message remains readable. Correction: Use authenticated encryption when confidentiality is needed.
Mismatched encodings
UTF-8, hex, Base64, and raw bytes produce different inputs. Correction: Specify exact byte encoding on both sides.
Best practices
- Generate and store keys in a key-management system.
- Define canonical message bytes.
- Use constant-time tag verification in the application.
Related operations and differences
Basic Auth Header Generator
Choose Basic Auth Header Generator when you need to generate a Basic Authorization header locally.; use HMAC Generator specifically for hmac.
JWT Expiration Checker
Choose JWT Expiration Checker when you need to inspect the exp claim in a JWT.; use HMAC Generator specifically for hmac.
JWT Header Viewer
Choose JWT Header Viewer when you need to decode a JWT header without verifying its signature.; use HMAC Generator specifically for hmac.
JWT Payload Viewer
Choose JWT Payload Viewer when you need to decode a JWT payload without verifying its signature.; use HMAC Generator specifically for hmac.
Passphrase Generator
Choose Passphrase Generator when you need to generate a local random multi-word passphrase.; use HMAC Generator specifically for hmac.
Password Entropy Calculator
Choose Password Entropy Calculator when you need to calculate estimated entropy from an assumed character pool.; use HMAC Generator specifically for hmac.
Limitations and privacy
- Text and key are UTF-8 strings, not arbitrary uploaded bytes.
- Output is hexadecimal only.
- No key management, verification flow, encryption, or protocol canonicalization.
The entered value is processed locally in this browser. Avoid using an untrusted device for real credentials or secrets.
Frequently asked questions
Can HMAC be decrypted?
No; it is an authentication tag.
Does it hide the message?
No.
Why do whitespace changes alter the tag?
They change the input bytes.
Should I paste production keys?
No.