Paste the message on the left and enter the secret key below — the HMAC appears on the right as a lowercase hexadecimal string, updating live as you type. Both message and key are handled as UTF-8, computation uses the browser's Web Crypto API, and nothing you enter is uploaded anywhere.
No. The HMAC is computed entirely in your browser with the Web Crypto API — the message and the secret key never leave your device, and the page works offline.
An HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key. Unlike a plain hash, only someone who knows the key can produce or verify the code, so it proves both integrity (the message wasn't changed) and authenticity (it came from a key holder).
Everywhere APIs need tamper-proof requests: webhook signatures (Stripe, GitHub, Slack), API request signing (AWS SigV4), session tokens, and JWTs with HS256/384/512 — which are exactly HMAC-SHA256/384/512 over the token.
If you just need a checksum or fingerprint of data, a plain hash is enough — use the hash generator. If the code must be verifiable only by parties who share a secret (signatures, authentication), you need an HMAC.
HMAC-SHA256 is the standard choice and what most APIs expect. SHA-384/512 offer longer outputs; HMAC-SHA1 survives in older APIs and, unlike plain SHA-1, is still considered secure as an HMAC — but prefer SHA-256 for new systems.