Skip to main content
NeatUtility

HMAC Generator

Security & HashingMemory Only100% Client-Side
Ready
TEXT
0 lines0 chars
0 B / 4.77 MB
About this tool, examples & FAQ

Compute keyed-hash message authentication codes (HMAC) using SHA-256, SHA-512, SHA-384, SHA-1, or MD5 entirely in your browser with custom UTF-8, hex, or base64 keys.

Key facts

Verified capabilities and limits of this utility
Accepted inputPayload message and secret cryptographic key
AlgorithmsHMAC-SHA256, HMAC-SHA512, HMAC-SHA384, HMAC-SHA1, and HMAC-MD5, or all five simultaneously
Key encodingsUTF-8 plain text, hexadecimal bytes, or Base64 encoded bytes
Output formatHexadecimal (lowercase or uppercase) or Base64 string
Max message size6 MB
Execution deadline2 s
Processing locationBrowser-only: keys and payloads never leave your machine

How to use

  1. Paste your message payload (JSON, text, webhook body) into the Message field.
  2. Enter your shared secret key into the Secret Key field.
  3. Select your secret key encoding (UTF-8, Hex, or Base64).
  4. Choose your hash algorithm (HMAC-SHA256 is the standard for GitHub, Stripe, and AWS).
  5. Select output encoding (Hex or Base64) and click 'Run'.
  6. Copy the computed authentication code to verify incoming webhooks or sign API requests.

Example

RFC 4231 HMAC-SHA256 Test Vector

Input

what do ya want for nothing?
Jefe

Example output

5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

Edge cases

Empty payload or empty key

HMAC calculation with an empty message or empty key is mathematically valid according to RFC 2104 and produces the exact standard digest.

Hexadecimal and Base64 keys

If you select Hex or Base64 secret key encoding, the tool parses the raw decoded bytes before computing the HMAC digest.

Legacy MD5 and SHA-1 warning

HMAC-MD5 and HMAC-SHA1 trigger a DEPRECATED_ALGORITHM warning because MD5 and SHA-1 have known collision vulnerabilities.

How it works

  1. Parses the secret key based on the chosen encoding (UTF-8, Hexadecimal, or Base64).
  2. Converts message text to exact UTF-8 bytes.
  3. Applies the RFC 2104 inner and outer hash pads with the chosen cryptographic hash function.
  4. Formats the resulting authentication tag as hexadecimal or Base64.

Related workflows

Frequently asked questions

What is an HMAC and why is it used?

HMAC stands for Hash-based Message Authentication Code (RFC 2104). It combines a cryptographic hash function (like SHA-256) with a secret key to verify both data integrity and data authenticity, ensuring that a message has not been tampered with and comes from a trusted sender.

What is the difference between a hash and an HMAC?

A regular hash (like SHA-256) only verifies data integrity and takes only an input message. An HMAC requires both a message and a secret key, proving that the creator of the hash knew the secret key.

How do webhook providers use HMAC?

Services like Stripe, GitHub, Shopify, and Slack calculate an HMAC signature of the HTTP request body using a shared secret and send it in a header (e.g. Stripe-Signature or X-Hub-Signature-256). The receiving server recomputes the HMAC and compares it to confirm the request is genuine.

What is the ideal secret key length for HMAC-SHA256?

According to RFC 2104, the key length should ideally match the output block size of the hash function (32 bytes / 256 bits for SHA-256). Keys longer than the block size are hashed first, and shorter keys are padded with zeros.

References