HMAC (Hash-based Message Authentication Code) is a technique that combines a secret key with a hash algorithm to verify both the integrity and authenticity of a message. It ensures the message hasn't been tampered with during transmission and genuinely comes from the holder of the secret key. HMAC is widely used in API signing, JWT tokens, and webhook verification.

What hash algorithms does HMAC support?

This tool supports three mainstream HMAC algorithms: HMAC-SHA256 (most common, recommended for most scenarios), HMAC-SHA384 (higher security, suitable for sensitive data), and HMAC-SHA512 (highest security, ideal for financial and payment scenarios). Stronger algorithms produce longer HMAC values and are slightly slower to compute.

How is HMAC different from regular hashing (MD5, SHA256)?

Regular hashing (like SHA256) only ensures data integrity — anyone can compute the hash of the same data. HMAC requires a secret key to compute, meaning only those who know the key can verify the HMAC. Therefore, HMAC simultaneously verifies both message integrity and source authenticity, preventing forgery and tampering attacks. Never use plain hashing for authentication.

How is HMAC used in API authentication?

The typical API signing flow: Server and client share a secret key → Client signs request parameters + timestamp with HMAC → Signature is attached to request headers → Server recomputes HMAC with the same key and parameters → Compares signatures. This verifies request legitimacy and prevents replay attacks. Major cloud services (AWS, Alibaba Cloud) use HMAC for API authentication.

What's the difference between Base64 and Hex output?

Hex (hexadecimal) represents each byte as two hex characters — readable but 2x the original data length. Base64 uses 64 characters for encoding, about 1.33x the original data length, making it more compact. Most API signatures (JWT, AWS Signature V4) use Hex, while HTTP header authentication often uses Base64. Both are interconvertible with no security difference.

Is my secret key and data secure?

This tool runs entirely in your browser. All HMAC computations use your browser's built-in Web Crypto API and happen locally on your device. Your secret key and message content are never uploaded to any server. The tool works even when offline. Your sensitive data (including the key) always remains on your own device.

HMAC Generator - Free Online HMAC Hash Calculator Tool

How to Use

Compute HMAC hashes locally using your browser's Web Crypto API. Ideal for API signing, JWT authentication, webhook verification, and message integrity checks.

Key Features:

🔐 Supports HMAC-SHA256 / SHA384 / SHA512
🔣 Hex and Base64 output encoding
⚡ Uses native Web Crypto API
📋 One-click copy result
🔒 100% client-side, no server upload

🔐 HMAC Generator

How to Use