HMAC Generator
Type a message and a secret key, pick a hash function, and get the HMAC signature in hex or Base64. Paste a signature you were given to see whether it matches. The key can be text or raw hex bytes. The plain hash of the message is shown beside it so you can see what the key changes. Everything runs in your browser.
256 bit result, 64 byte blocks.
d7a8fbb307d7809469ca9abcb0082e4f8d5651e46d3cdb762d02d0bf37c9e592
An HMAC is a hash that is mixed with a secret key, so only someone who knows the key can create or check it. APIs and webhooks use it to prove that a message came from the right sender and was not changed on the way. It differs from a plain hash, which anyone can calculate. Compare signatures in your own code with a constant-time function, and keep keys out of places others can read. This tool runs in your browser and nothing is uploaded, but treat a production key as you would a password and prefer test keys here.
Related Tools
[5 suggestions]Hash Generator (MD5, SHA-1, SHA-256, SHA-512)
Generate MD5, SHA-1, SHA-256, and SHA-512 cryptographic hashes live from any text using the native Web Crypto API.
Developer & WebJWT Decoder
Decode the header and payload of a JSON Web Token and see its expiry. Reads the token without checking the signature.
Developer & WebBase64 Encoder / Decoder
Easily encode plain text to Base64 format or decode Base64 back to readable text.
Developer & WebPassword Generator
Generate cryptographically secure random passwords with custom length and character sets.
Developer & WebUUID Generator
Generate cryptographically random UUID v4 identifiers instantly, one or in bulk.
Developer & WebAbout the HMAC Generator
An HMAC, short for hash-based message authentication code, is a hash that depends on a secret key. Without the key nobody can produce or check it, so a matching HMAC shows that a message came from someone who holds the key and was not changed on the way. It is defined in RFC 2104: the key is padded to the hash's block size, mixed with two fixed patterns, and hashed around the message twice. A key longer than the block is hashed first. Web APIs sign requests with HMACs, webhooks often carry one so the receiver can verify the sender, and the HS256 signature of a JSON Web Token is an HMAC with SHA-256. A plain hash such as SHA-256 is different, because anyone can calculate it. A good test is the one on Wikipedia: with the key "key" and the message "The quick brown fox jumps over the lazy dog", HMAC-SHA256 is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8 and HMAC-SHA1 is de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9. SHA-1 is no longer collision resistant, but HMAC-SHA1 is still considered sound for authentication, though new systems should prefer SHA-256. SHA-384 and SHA-512 give longer signatures. When you check a signature in your own code, compare it with a constant-time function, and never log or share the key. The tool writes the result as lowercase hex by default, with upper case and Base64 as options.
What is an HMAC?▾
An HMAC is a hash that is calculated with a secret key. Only someone with the key can create or verify it, so it proves that a message came from the key holder and was not altered.
What is the difference between a hash and an HMAC?▾
A hash such as SHA-256 has no secret, so anyone can compute it from the message. An HMAC mixes in a secret key, so only the key holders can produce the correct value.
Which hash function should I use for HMAC?▾
HMAC-SHA256 is the common choice. HMAC-SHA1 is still considered secure for authentication but is being phased out, and SHA-384 and SHA-512 give longer outputs. Use whatever the service you are signing for requires.
How do I verify an HMAC signature?▾
Calculate the HMAC of the message with the shared key and compare it with the signature you received, using a constant-time comparison in code. Paste the received value into the check box here to test it.
Is it safe to enter my secret key here?▾
The key stays in your browser and is never sent to a server, but it is best to use test keys. Treat a production key like a password.