HMAC Generator guide
Create SHA-256, SHA-384, or SHA-512 hash-based message authentication codes from a UTF-8 message and secret key.
What this tool does
HMAC Generator combines a secret key, a message, and a selected SHA-2 algorithm through the standard HMAC construction. It uses the browser's Web Crypto implementation and returns the authentication code as lowercase hexadecimal or Base64.
An HMAC helps a party that knows the same secret check that a message has not changed and was authenticated with that shared key. Common uses include webhook verification, request signing, test vectors, API integration debugging, and comparing an implementation with documentation.
HMAC is different from a plain hash. A normal digest uses only the message and can be reproduced by anyone. HMAC incorporates a secret and is designed to avoid the structural weaknesses of simply concatenating a key with a message before hashing.
How to use it
- Enter the message exactly as the other system receives it.
- Enter the shared secret or, preferably, a dedicated test secret.
- Choose SHA-256, SHA-384, or SHA-512.
- Choose hexadecimal or Base64 output.
- Select Generate HMAC and compare every character with the expected value.
Whitespace, line endings, text encoding, capitalization, and message order all affect the result. This tool encodes both fields as UTF-8 text. It does not interpret a secret as hexadecimal or Base64 key bytes.
Benefits
- Supports three SHA-2 HMAC algorithms
- Produces hexadecimal or Base64 output
- Uses the native Web Crypto API
- Clearly treats message and key as UTF-8 text
- Performs generation locally in the current browser tab
Security notice
Do not paste a production secret into a website or browser environment you do not fully trust. Local processing prevents ToolSeta from receiving the fields, but malicious extensions, compromised devices, screen sharing, clipboard managers, and injected scripts are separate risks. Use test keys for debugging and rotate any secret that may have been exposed.
HMAC does not encrypt the message, hide its contents, establish public identity, or replace a digital signature. Both sides must already share the secret securely. Compare authentication codes with a constant-time method in production code, and follow the protocol's exact canonicalization rules.
Use the SHA Hash Generator only when you need an unkeyed digest for byte comparison. A plain SHA digest cannot replace an HMAC when the receiving system expects shared-key authentication.