HMAC Calculator

Compute HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 signatures for any message and secret key, in hex and base64. Runs locally with Web Crypto.

How it works

• HMAC wraps the chosen hash algorithm with a secret key: the key is padded, XOR-mixed into two inner/outer pads, and hashed in a specific order.
• The result has the same length as the underlying hash — 256, 384, or 512 bits — regardless of message or key length.
• Computing the same HMAC requires the shared secret, so a valid signature proves the message came from someone who knows the key.
• Everything is calculated in your browser with crypto.subtle; no data is sent anywhere.

About HMAC

HMAC (Hash-based Message Authentication Code) is a keyed hash: it combines a hash function such as SHA-256 with a shared secret to produce a signature that verifies both integrity and authenticity. Unlike a plain hash, which anyone can recompute, an HMAC is unpredictable without the key — changing even one bit of the message produces a completely different signature. The secret is the root of trust, and the message can be stored or transmitted openly.

Use HMAC whenever two parties share a secret and need to prove messages were not tampered with or forged: API request signing, webhook payload verification, and session tokens are the most common cases. Never use a plain hash for these — an attacker can recompute MD5 or SHA-256 without the key. Keep the secret key out of client-side code, rotate it periodically, and use separate keys for different purposes. The signature authenticates, but it does not encrypt: if confidentiality is also needed, combine HMAC with encryption (for example, AES-GCM).