checksum.name

keyed hashing · local only

HMAC Generator

Generate HMAC-SHA-256 (and SHA-1/384/512) authentication codes from a secret key and message — computed entirely in your browser.

All files are processed locally in your browser — your data never leaves your device.

HMAC Generator

About HMAC

HMAC (Hash-based Message Authentication Code, RFC 2104) combines a cryptographic hash function with a secret key. A plain hash proves only that data hasn't changed; an HMAC additionally proves the data came from someone who knows the key. That property makes HMAC-SHA-256 the backbone of API request signing (AWS Signature v4 and countless payment and webhook APIs), JWT tokens with the HS256 algorithm, and webhook verification schemes from GitHub, Stripe and Slack.

This HMAC generator is a developer's scratchpad for exactly those cases: paste the secret and the message body, pick the hash function, and compare the output against what your code or the remote service produced. It uses the Web Crypto API's native HMAC implementation, so results match OpenSSL (openssl dgst -sha256 -hmac "key"), Python's hmac module, and every other standards-compliant library. Output is lowercase hexadecimal.

Your secret key stays local

Pasting a secret key into a website is normally a terrible idea — which is why this one never transmits it. The key and message are processed in-browser only; no request is made, nothing is logged, and you can verify that by loading the page and switching off your network. For unkeyed digests, use the SHA-256 generator or browse the other tools below.

Also try our: SHA256 Hash Generator · SHA512 Hash Generator · Hash Compare Tool

§ Frequently Asked Questions

Is my secret key sent anywhere?
No. The HMAC is computed locally in your browser using the Web Crypto API. Neither the key nor the message is ever transmitted or stored.
What is the difference between a hash and an HMAC?
A hash fingerprints data; anyone can compute it. An HMAC mixes in a secret key, so only parties who know the key can produce or verify it — proving both integrity and authenticity.
Will this output match OpenSSL and other libraries?
Yes. The tool implements standard RFC 2104 HMAC via the Web Crypto API, so results match openssl dgst -hmac, Python hmac, Node.js crypto, and other compliant implementations. The key is interpreted as UTF-8 text.
Which HMAC algorithm should I use?
HMAC-SHA-256 is the modern default and what most APIs specify. Use SHA-1 or SHA-512 variants only when the service you are integrating with requires them.

Other Hash Tools

Checksum Calculator MD5 Hash Generator SHA256 Hash Generator SHA512 Hash Generator SHA1 Hash Generator CRC Calculator File Checksum Calculator Hash Compare Tool