HMAC Generator

How to use

1. 1.Choose SHA-256, SHA-384 or SHA-512 and confirm the protocol expects a full HMAC tag.
2. 2.Select UTF-8 or hex independently for the key and message, then enter the exact bytes without extra formatting.
3. 3.Generate the tag and copy hex or standard Base64; convert or truncate only when the protocol explicitly requires it.

About HMAC Generator

HMAC Generator calculates a keyed-hash message authentication code with SHA-256, SHA-384 or SHA-512. Enter the secret key and message as UTF-8 text or exact hexadecimal bytes, choose the hash, and receive the complete tag in lowercase hex and standard padded Base64. The operation uses the browser Web Cryptography API and does not send inputs to the site server.

HMAC combines a cryptographic hash with a shared secret key. A verifier that possesses the same secret and exact message bytes can calculate the same tag, which can detect modification and authenticate the party that knew the key. HMAC does not hide the message. Anyone who sees plaintext can still read it, and anyone who learns the key can forge valid tags.

Byte identity is essential. Text mode encodes both fields as UTF-8, so accented letters, CJK characters and emoji occupy multiple bytes. Hex mode accepts only an even number of hexadecimal digits and preserves every byte, including zero. It rejects prefixes, spaces, colons and odd nibbles so an accidental formatting character cannot silently change a protocol value.

The selected hash changes tag length: SHA-256 returns 32 bytes, SHA-384 returns 48, and SHA-512 returns 64. This page always displays the full output. A protocol may require truncation, a prefixed algorithm identifier, a canonical request string, a binary envelope or Base64url rather than standard Base64. Apply those rules only from the protocol specification; do not trim a tag by eye.

Key handling determines security. Use independently generated high-entropy key material appropriate for the protocol, distribute it through a protected channel, separate keys by purpose, rotate after compromise and compare tags with a constant-time function on the server. A human password is not automatically a strong HMAC key. When a password must become a key, use the exact password-based derivation scheme and parameters required by the application.

The page limits each decoded field to 1,000,000 bytes. Asynchronous jobs carry an identity token, so changing input while Web Crypto is working prevents an older result from overwriting the new state. Empty keys and messages are rejected by this interface to prevent accidental clicks, even though some low-level standards can define behavior for zero-length data.

Correctness is locked to eight full RFC 4231 conformance tags. The cases cover short keys, binary repeated-byte keys and data, keys smaller than the digest, and data crossing hash block boundaries. SHA-256 and SHA-512 are checked for four independent inputs, while the UI also exposes the WebCrypto-defined SHA-384 option.

Use the generator only after identifying the exact bytes and algorithm from the governing protocol. Prefer hex mode for published vectors and binary fields. Compare the complete tag in the required encoding, avoid pasting production secrets into an untrusted device, and remember that successful agreement proves shared key and byte consistency, not message confidentiality. Hex and Base64 are only renderings of identical tag bytes. The page does not emit Base64url, prepend an algorithm identifier or package the message with its tag. Store and transmit each field according to the protocol, since visually similar encodings are not interchangeable and decoding them produces different bytes.

Methodology & sources

The chosen bytes are imported as a non-exportable WebCrypto HMAC key with SHA-256, SHA-384 or SHA-512. subtle.sign returns the full tag, which is rendered independently as lowercase hex and padded Base64.

• RFC 4231 test vectors
• NIST FIPS 198-1
• W3C Web Cryptography HMAC

Frequently asked questions

Related tools

• JWT Generator
  Create a compact HS256 JWT from strict JSON claims with standards-based base64url encoding and browser-native HMAC-SHA-256.
• Checksum Calculator
  Calculate explicit XOR-8 BCC, Modbus ASCII two's-complement LRC, and byte-sum modulo 256 values from UTF-8 text or hex bytes.
• CRC32 Calculator
  Calculate CRC-32/ISO-HDLC from UTF-8 text or explicit hexadecimal bytes with fixed parameters and an eight-digit result.
• AES Encryption Online
  Encrypt text into a portable authenticated AES-256-GCM JSON package or decrypt a package with its password entirely in your browser.
• ASCII Converter
  Convert standard 7-bit ASCII text to decimal codes or decode decimal codes back to exact ASCII characters locally.
• Base100 Encoder / Decoder
  Encode UTF-8 text as the original Base100 emoji mapping or strictly decode Base100 symbols back to valid UTF-8 text.

• Convert Hex Files to Readable Text Without Errors
• Gzcompress Online: Compress and Decode Text in Your Browser
• Convert Any File to Base64 Without Uploading It
• How to Calculate CRC-32 Checksums for Data Integrity
• How to Calculate Checksum: XOR-8 and Modbus LRC
• Convert Base 10 to Hex Quickly with Base64 to Hex Converter
• Decode Base58 Strings Back to Readable Data in One Click
• Encrypt and Decrypt Text with AES-256 Online in Your Browser
• Decode a Caesar Cipher in Python Without Manual Loops
• Convert Binary to Text Instantly in Your Browser
• Turn a Base64 String Back into an Image in One Click
• Decode Base32 Strings Back to Readable Text in One Click
• How to Convert ASCII to Binary: A Practical Walkthrough
• Text to Hex: Encode UTF-8 Strings the Right Way
• How Binary to Text Conversion Works in Plain English
• Convert Hex Dump to Text Without Errors or Silent Replacements
• Convert an ASCII File to Excel in Minutes Without Coding
• How to Generate a Password Hash the Easy Way
• How to Translate Morse Code: Text and Audio Online
• Decode Base64 from the Command Line Without Installing Anything