100% local and secure
Your data stays on your device and is never sent to our servers.
HMAC Generator & Verifier
Create an HMAC from text and a secret key, then compare it with an expected value without uploading your data.
- 100% local
- Instant
- Free
- No account
- Works offline
- Clipboard
Data not sent
HMAC settings
Generated HMAC
Why use this tool?
Generate an HMAC to authenticate a message with a secret key. Processing stays in your browser.
Smart processing
Generate or verify sensitive data with clear and immediate controls.
Supported formats
Strings, keys, hashes, and technical formats depending on the security function.
Save time
Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.
Fonctionnement
How does this tool work?
The tool imports the secret key into Web Crypto and signs the message with HMAC using SHA-256, SHA-384 or SHA-512. The result is displayed as hexadecimal text. When an expected value is supplied, the two values are compared locally.
Use cases
Sign a webhook
Calculate the expected HMAC while testing webhook or API signatures without exposing the secret.
Verify authenticated integrity
Compare a received HMAC with a locally recalculated value using the same message and key.
Build a local workflow
Reuse the HMAC output in encoding, validation or data preparation pipelines.
Guide
How to use this tool
- 1
Add the message
Enter the content to authenticate.
- 2
Provide the key
Enter the secret key and select the algorithm.
- 3
Generate or verify
Calculate the HMAC and optionally compare it with an expected value.
Examples
HMAC signature
Input
message + secret keyResult
hexadecimal HMACTips and best practices
- Use a sufficiently long random secret key.
- Always compare values created with the same algorithm and encoding.
- Keep the secret key separate from the HMAC value.
Frequently asked questions
How is HMAC different from a hash?
HMAC combines hashing with a secret key, providing message authentication as well as integrity checking.
Does my data leave the browser?
No. The message and secret key are processed locally with Web Crypto.
Which algorithm should I choose?
SHA-256 fits most modern uses, while SHA-384 and SHA-512 produce longer values.
Was this tool useful?
Read next
GuideBest practicesBeginner
Hashes, integrity and fingerprint comparison: what a hash can really prove
Distinguish hashing from encryption and encoding, understand SHA-256 and SHA-3, collisions and the limits of a hash without authentication.
29 August 20262 minRead
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
Subresource Integrity (SRI): verify external resource integrity
Understand how SRI hashes help detect unexpected changes to static third-party scripts and stylesheets, and where SRI does not apply.
29 August 20261 minRead
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 minRead
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Complementary tools
Security & privacy
Hash generator
Generate a text hash using several common hashing algorithms.
100% local
Use this toolSecurity & privacy
SRI hash generator
Generate a Subresource Integrity hash for a file or pasted content.
100% local
Use this toolSecurity & privacy
Hash comparator
Compare two hashes or checksums to immediately verify whether they match exactly.
100% local
Use this tool