HMAC Generator
Hash FunctionsProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool computes HMAC (Hash-based Message Authentication Code) using the browser's
native crypto.subtle.sign() API. It combines a secret key with a cryptographic hash
function to produce an authentication tag that verifies both message integrity and authenticity.
Algorithm Details
- Algorithms: HMAC-SHA256 (256-bit output), HMAC-SHA512 (512-bit output)
- Key import:
crypto.subtle.importKey('raw', key, { name: 'HMAC', hash }, false, ['sign']) - Signing:
crypto.subtle.sign('HMAC', key, message) - Output format: Lowercase hexadecimal string
- Implementation: Native Web Crypto API — no JavaScript libraries
How HMAC Works
- The secret key is combined with the message using a specific padding scheme
- The padded key+message is hashed once:
Hash((key ⊕ opad) || Hash((key ⊕ ipad) || message)) - The result is a fixed-length tag that can only be reproduced by someone who knows the key
Common Use Cases
- API request signing (verify requests come from authorized clients)
- JWT token generation and verification
- Secure session management
- Message authentication between trusted parties
- File integrity verification with a shared secret
Frequently Asked Questions
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the integrity and authenticity of a message. It combines a cryptographic hash function with a secret key to produce a fixed-length authentication tag.
What is the difference between HMAC and a regular hash?
A regular hash only verifies data integrity — anyone can compute it. HMAC adds a secret key, so only someone who knows the key can produce or verify the authentication tag. This provides both integrity and authenticity.
When should I use HMAC?
Use HMAC when you need to verify that a message came from a trusted source and hasn't been tampered with. Common uses include API authentication, JWT tokens, session verification, and secure message exchange.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.