Tool
What the HMAC Generator does
HMAC Generator: generates HMAC from Message, Secret key and Algorithm.
With Message, Secret key and Algorithm entered, the HMAC Generator works out HMAC. Change any input and the output follows immediately.
Reusing a password is still the single most common way accounts fall over. That is usually what brings someone verifying a download here.
Generated secrets never touch the network. They are produced in your browser and stay there.
Field definitions, the method, and a worked example from the default values are all set out further down the page.
What do the HMAC Generator fields mean?
The HMAC Generator uses 3 inputs. None of the boxes start empty. The page loads with a worked set of values you can edit or replace.
| Field | What to enter | Default |
|---|---|---|
| Message | paste or type any amount of text | The quick brown fox |
| Secret key | required | my-secret-key |
| Algorithm | choose from HMAC-SHA-256, HMAC-SHA-1 or HMAC-SHA-512 | HMAC-SHA-256 |
How does the HMAC Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
If something is off you are told which field, not given a generic failure.
What a typical run looks like
You provide: Message, Secret key and Algorithm
What happens: the file is read into memory by your browser, processed locally, and offered back as a download. It is never uploaded.
You get back: the finished file to download, with a line in the panel saying what was done.
Because the work is local, speed depends on your device rather than our servers, and large files are limited only by available memory.
Why HMAC exists when a plain hash already exists
HMAC is a specific, provably secure construction, and it exists because the naive approach (hashing a secret key concatenated with a message) is genuinely broken for the SHA-1/SHA-256/SHA-512 family.
Worth knowing
- SHA-1, SHA-256 and SHA-512 all use the Merkle-Damgård construction, which is vulnerable to a length-extension attack: given hash(secret + message), an attacker who does not know the secret can still compute hash(secret + message + extra) for attacker-chosen extra, without ever learning the secret.
- HMAC defeats this by hashing the key in twice in a specific nested structure, HMAC(K, m) = H((K′⊕opad) ∥ H((K′⊕ipad) ∥ m)). It is the construction itself, not merely "using a hash," that carries the security proof.
- Use HMAC, not a bare hash, anywhere a message needs to prove it came from someone holding a shared secret. Webhook signature verification, API request signing, and authenticated cookies are the common real-world cases.
- The secret key should be at least as long as the underlying hash’s output: 32 bytes for HMAC-SHA-256, 64 for HMAC-SHA-512. A short, guessable key defeats the construction regardless of which hash backs it.
Read next: How Hashing Works: MD5, SHA-1, SHA-256 and Why Two Are Broken
How to use it
- Paste your content into Message.
- Enter Secret key.
- Pick a value for Algorithm: the options are HMAC-SHA-256, HMAC-SHA-1 or HMAC-SHA-512.
- No submit step is needed; the output updates while you edit.
- Look at HMAC in the output panel.
- Use Copy Link if you want the same setup again later, or Print for a paper copy.
What this tool does not do
- Randomness comes from your browser's cryptographic random source, which is suitable for passwords and keys.
- Anything generated here is only as safe as where you store it afterwards.
- It will not warn you that a different tool would suit your question better.
Frequently asked questions
Message, Secret key and Algorithm, nothing else. Each field is pre-filled with a sensible default, so nothing is mandatory before you see a result.
No. There is no account, no session and no storage. The values exist only while the tab is open.
Free for any use, personal or commercial.
The formula is shown above precisely so you do not have to take the accuracy on trust.