HMAC Generator

Free online HMAC generator supporting MD5, SHA1, SHA256 and SHA512 with a secret key. Hex or Base64 output. Runs entirely in your browser.

Runs locally · data never uploaded
Advertisement

How to use

What it does

HMAC (Keyed-Hash Message Authentication Code) hashes a message together with a secret key, so it both verifies integrity and proves who sent the data. This tool supports MD5, SHA1, SHA256 and SHA512, lets you switch between hex and Base64 output, and computes everything locally in your browser.

Example

Set the key to devutils-secret, type Hello, HMAC! and pick SHA256:

64a3d10cf99ea5392c2a1feaae08e307d0c4ab1695522f6d98d9a7e5eec6c229

Switching to Base64 output gives the value starting with ZKPc/b. Enable "Uppercase" for an all-caps digest.

Tips

Both sides must share the same secret key to verify a MAC. Distribute the key over a secure channel and never send it alongside the digest. The verifier recomputes the HMAC with the same key and algorithm and compares.

FAQ

Q1.How is HMAC different from a plain hash?
A hash only checks integrity and anyone can compute it. HMAC mixes in a secret key known only to the two parties, so it also authenticates the sender — an attacker cannot forge a MAC without the key.
Q2.Is my key uploaded?
No. The key and message are processed inside your browser; the tool works offline and no key ever appears in network requests.
Q3.Which algorithm should I pick?
Prefer SHA-256 or SHA-512 for new systems. SHA-1 and MD5 are broken and only kept for legacy compatibility. Base64 output is shorter and fits HTTP headers or JSON fields.
Q4.Why is the result always the same for the same input?
HMAC is deterministic: same key, algorithm and input always produce the same output, which is exactly what comparison verification relies on. Use encryption if you need randomness.
Advertisement

Related tools