Tools Blog

HMAC Generator

Scan to open this page

100% client-side — your message and secret key are hashed with the browser's own Web Crypto API and never transmitted anywhere.

Compute an HMAC from a message and secret key live, with an explicit key encoding selector (UTF-8, Hex, or Base64) to avoid the most common cause of mismatched results.

How it works

  1. Enter your message and secret key
  2. Pick the hash algorithm (SHA-1/256/384/512) and how the key should be interpreted (UTF-8 text, Hex, or Base64)
  3. The HMAC updates live below — no button, and nothing is ever sent anywhere

Frequently asked questions

Is my secret key sent to a server?

No — HMAC is computed with the browser's own Web Crypto API, entirely client-side. The key never leaves your browser.

Why does key encoding matter?

The same-looking string produces a different HMAC depending on whether it's read as UTF-8 text or as Hex/Base64-encoded bytes. Many tools pick one silently; here you choose explicitly so the result matches what you expect.

Which algorithms are supported?

SHA-1, SHA-256, SHA-384, and SHA-512.

#HmacGenerator#HmacGeneratorKeyEncodingHexBase64#HmacSha256OnlineClientSide#HmacGeneratorLiveNoButton

Related tools

JWT Encoder/Decoder/Verifier JWT Encoder/Decoder/Verifier SHA-256 Hash Generator SHA-256 Hash Generator

From the blog

The same secret key can produce a different HMAC on different tools, and it's rarely a bug in your code. It's key encoding, and most tools never let you choose.
dev

The same secret key can produce a different HMAC on different tools, and it's rarely a bug in your code. It's key encoding, and most tools never let you choose.

A common, well-documented gotcha: some HMAC tools read your key as UTF-8 text, others as hex or Base64 bytes, silently producing different results for the same-looking string. We checked a popular generator that also needs a button and shows ads. Ours is live, ad-free, and lets you pick the key encoding explicitly.

2026-08-29

Update history

  • 2026-08-30 Added: a cover image — used as the card thumbnail, social share image, and blog title image.
  • 2026-08-29 Launched: live HMAC generation (SHA-1/256/384/512) via Web Crypto API, explicit key encoding selector (UTF-8/Hex/Base64) to fix the common mismatch cause, no server transmission.