HMAC Generator Online — SHA-256, SHA-512, SHA-1

What is HMAC?

HMAC (Hash-based Message Authentication Code) is a cryptographic mechanism that combines a secret key with a hash function (such as SHA-256) to produce an authentication code. It is used to verify both the data integrity and the authenticity of a message. Unlike a plain hash, HMAC requires the secret key to produce or verify the signature, making it resistant to forgery.

Which HMAC algorithm should I use?

HMAC-SHA-256 is the industry standard and is suitable for the vast majority of applications, including API authentication (e.g., AWS Signature v4, JWT HS256) and webhook verification. HMAC-SHA-512 offers a larger output and higher security margin for very sensitive contexts. HMAC-SHA-1 is considered legacy — avoid it in new systems unless required for compatibility.

Common uses of HMAC

• API request signing (e.g., AWS, Stripe webhook verification)
• JWT signing with HS256, HS384, or HS512 algorithms
• Password-based key derivation (PBKDF2 uses HMAC internally)
• TLS/SSL handshake authentication
• Message integrity checks in secure messaging protocols

Output formats explained

Hex (lowercase / uppercase) represents each byte as two hexadecimal digits (0–9, a–f). This is the most common format for displaying hashes and HMACs. HMAC-SHA-256 produces a 64-character hex string. Base64 encodes the raw bytes using the Base64 alphabet, producing a shorter string (HMAC-SHA-256 = 44 characters). Base64 is often used in HTTP headers and JWT tokens.

Is this tool secure?

Yes. This HMAC Generator runs entirely in your browser using the native Web Crypto API (crypto.subtle). Your message and secret key are never transmitted over the network or stored anywhere. You can even use this tool offline after the page has loaded.

Frequently Asked Questions