HMAC Generator
Generate HMAC authentication codes from a message and secret key using standard SHA algorithms directly in your browser.
How to Use the HMAC Generator
Generate RFC 2104-compliant authentication tags in four simple steps:
Enter Message
Paste your request body, JSON payload, or plain text string into the message input field.
Enter Secret Key
Type your shared secret key into the password field. The key remains entirely within browser memory.
Select Algorithm
Choose between HMAC-SHA-256, HMAC-SHA-512, or HMAC-SHA-384, and pick Hex or Base64 output format.
Generate & Copy
Click "Generate HMAC" and copy the resulting cryptographic signature directly to your clipboard.
What is an HMAC (Hash-based Message Authentication Code)?
An HMAC (specified in RFC 2104 and FIPS PUB 198-1) is a cryptographic construction for calculating a message authentication code involving a cryptographic hash function in combination with a secret key.
Unlike a simple hash function (which only guarantees that data was not unintentionally altered), an HMAC guarantees both data integrity and authenticity. Because computing the HMAC requires knowledge of the secret key, an attacker cannot forge an authentication tag even if they know the hash algorithm being used.
HMAC Example: Standard RFC 4231 Test Vector
Verify that your implementation matches standardized cryptographic test vectors:
Message: "The quick brown fox jumps over the lazy dog"
Secret: "key"
Algorithm: HMAC-SHA-256f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8When Developers Use HMACs
Everyday software engineering patterns that rely on HMAC signatures:
Webhook Signature Verification
Verifying incoming webhook headers (such as Stripe-Signature or X-Hub-Signature-256) from payment processors.
API Request Authentication
Signing REST requests using AWS Signature Version 4, Twilio, or custom API gateway authorization models.
Stateless Session Cookies
Signing user session data stored in HTTP cookies to detect and block client-side tampering attempts.
Signed Download URLs
Generating time-limited download links for S3 buckets and CloudFront distributions.
Key Features of CodeCrate HMAC Generator
Secure, browser-based cryptographic implementation:
Native Web Crypto API
Powered by crypto.subtle.sign for hardware-level security without homebrew cryptographic code.
Zero Secret Key Storage
Secrets are never stored in localStorage, session cookies, or telemetry. Refreshing the page clears all keys.
Hex & Base64 Formatting
Toggle instantly between hexadecimal strings and Base64 output to match diverse API requirements.
One-Click Copy
Copy the generated authentication tag immediately with tactile visual feedback.
Important Technical Notes
Secret key remains in browser memory. It is never saved to localStorage, cookies, analytics, URLs, or server logs, and is not automatically exposed after refresh. All HMAC computations take place locally inside your browser memory using the native Web Crypto API.
Frequently Asked Questions
Got questions about HMAC generation? Find answers below:
What is an HMAC (Hash-based Message Authentication Code)?
An HMAC is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key (specified in RFC 2104). It verifies both data integrity and authenticity.
Are my secret keys saved or transmitted to a remote server?
No. The secret key is never sent over any network, logged, or saved to localStorage or cookies. All cryptographic computations execute strictly in your browser's private memory.
Which algorithm is recommended for API signing?
HMAC-SHA-256 is the dominant standard used by major API platforms like Amazon AWS Signature v4, Stripe, GitHub webhooks, and Twitter API for request authentication.
Can I output HMAC signatures as Base64?
Yes. Our tool allows switching between standard Hexadecimal output and Base64 format with a single click.
Does this tool support Unicode and special characters?
Yes. Both messages and secret keys are serialized using standard UTF-8 byte encoding before HMAC generation.
What is the difference between an HMAC and a standard hash?
A standard hash (like SHA-256) only verifies data integrity. Anyone can recalculate a hash if they change the message. An HMAC incorporates a shared secret key, ensuring that only someone possessing the secret could have created the authentication tag.
Related Developer Tools
Explore more free developer utilities from CodeCrate: