HMAC Generator
Runs locally in your browserAuthenticate messages with a shared secret
Input
UTF-8 text; an empty message is supported.
Text whitespace is preserved.
Advanced
Hex and Base64 keys are decoded strictly and must not contain spaces.
Output
HMAC authenticates a message using a shared secret. It is not encryption.
Message, secret and result stay in this tab and are never saved or uploaded.
About HMAC
HMAC authenticates a message with a shared secret; it does not encrypt the message. This tool uses native Web Crypto and keeps message, secret and result in memory. SHA-256 is the default; SHA-384 and SHA-512 are also available. The message limit is 1,000,000 UTF-16 units and the secret limit is 65,536 units.
How to use
Enter a message and a nonempty secret, choose an algorithm and output encoding, then select Generate HMAC. An empty message is valid. Advanced lets you decode the key as hex or canonical padded Base64. Text whitespace is preserved; encoded keys must not contain whitespace. Any edit clears the old result. Copy or download hmac.txt, or Clear to reset.
Limits and encodings
Messages are encoded as UTF-8 and may be empty. Secrets must decode to at least one byte. Hex keys need an even number of digits; Base64 keys use the standard alphabet with canonical padding, and Base64URL or whitespace is rejected. Base64URL output removes padding. Limits: 1,000,000 message and 65,536 secret UTF-16 units; longer input is rejected, never truncated.
