Skip to content

Generate and verify HMAC

Compute a keyed message authentication code, or check one you received.

Processed in your browser. Your files stay on this device. Nothing is uploaded to our servers.

No ads or third-party scripts on this page; your password and data never leave your browser.

HMAC proves that a message came from someone who knows the secret key and was not changed. It does not encrypt or hide the message.

Algorithm

Output format

Key format

Verify an HMAC

How to use HMAC Generator

  1. 1

    Enter the message and the secret key, and choose the key format.

  2. 2

    Pick HMAC-SHA256 or HMAC-SHA512 and the output format.

  3. 3

    Generate the MAC, or paste an expected MAC to verify it.

About HMAC Generator

An HMAC proves that a message came from someone who knows a shared secret key and that it has not been changed. It is widely used to sign API requests and webhooks. HMAC is not encryption: the message itself stays readable, and anyone can see it. This tool computes HMAC-SHA256 or HMAC-SHA512 for text, accepts the key as plain text, hex, or Base64, and outputs hex or Base64. Verification compares MACs in constant time. Everything runs in your browser; your key and message are never sent anywhere, and this page loads no ads or third-party scripts.

Frequently asked questions

Is HMAC the same as encryption?

No. HMAC only proves integrity and authenticity. The message is not hidden; use the Text Encryption tool if you need confidentiality.

Why does my result differ from another tool?

Check that the key format (text, hex, or Base64) and the exact message, including spaces and line breaks, are the same.

Which should I use, SHA-256 or SHA-512?

Use whatever the system you integrate with expects. Both are secure; HMAC-SHA256 is the most common.

Why does verification use constant-time comparison?

Comparing byte by byte with an early exit can leak timing information. A constant-time comparison avoids that.