OmniTools
securityDifficulty: 3/5

HMAC Generator

Compute an HMAC signature from a secret key and message using the Web Crypto API. Hex and Base64 output, entirely in your browser.

Your key stays here: The secret key is used only inside your browser’s Web Crypto API and is imported so that even this page cannot read it back. It is never transmitted or recorded.
Key encoding

This matters: the same key as text and as hex bytes produces different signatures. A mismatch against a server is almost always this setting.

Algorithm

HMAC-SHA-1 is not offered: SHA-1 should not be used for new signatures.

HMAC is not encryption: An HMAC proves that a message came from someone holding the shared secret and was not altered. It does not hide the message — anyone can still read it.

How it works

  1. Enter your secret key and the message to sign.
  2. Choose the hash algorithm, and the encoding your key is in.
  3. The signature is computed by your browser’s Web Crypto API and shown in hex and Base64.
Privacy & Processing: The key and message never leave your browser. The key is imported as a non-extractable CryptoKey, and neither it, the message, nor the signature is logged or sent to analytics.

Frequently Asked Questions

Is my secret key safe?

The key never leaves your browser. It is imported into the Web Crypto API as a non-extractable key, so not even the page can read it back, and it is never logged, stored, or included in any analytics event.

Which algorithms are supported?

HMAC with SHA-256, SHA-384 and SHA-512, computed by your browser’s own Web Crypto implementation rather than a bundled JavaScript library. HMAC-SHA-1 is deliberately not offered.

How should the key be encoded?

Choose UTF-8 text, hexadecimal or Base64. This matters: the same key expressed as hex bytes and as text produces different signatures, and picking the wrong one is the usual cause of a mismatch against a server.

What is HMAC used for?

Verifying that a message came from someone holding the shared secret and was not altered — webhook signatures, API request signing and token integrity. It is not encryption: the message is not hidden.

Related Tools

Hash GeneratorFile Hash Calculatorjwt Decoder