Compute HMAC-SHA1, SHA-256, SHA-384, or SHA-512 from a message and secret key. Hex or Base64 output with show/hide for secrets.
For testing and development. Do not generate production HMAC secrets in a browser.
Secret key is not included in shareable URLs.
Uses Web Crypto API. Nothing is sent to any server.
More free utilities you might find useful
Quick answers to common questions
SHA-256 for most APIs and webhooks. SHA-384 or SHA-512 when you need a longer digest. SHA-1 only for legacy systems.
Hex is common in APIs and logs. Base64 is more compact.
No. The secret key uses local state only and is never included in shareable URLs.
JWT HS256 uses HMAC-SHA256. See JWT Generator for full tokens.
Your data is processed entirely in your browser. Nothing is sent to any server.