HMAC Generator & Verifier
Generate and verify HMAC-SHA-256, SHA-384 and SHA-512 locally with native Web Crypto.
Key encoding is explicit. Hex needs complete byte pairs; standard Base64 may omit padding, but must have canonical pad bits and no whitespace. Keys stay in memory.
Message
HMAC output
Text input is encoded as UTF-8 before HMAC calculation.
Ready.
A shared-secret authenticator, not encryption.
A hash uses no secret. An HMAC uses a shared secret to provide integrity and authenticity. Encryption protects confidentiality. Anyone holding the HMAC secret can generate a valid MAC; a valid MAC does not identify a particular person or conceal the message.
Exact bytes and explicit encodings.
Text input is encoded as UTF-8 before HMAC calculation. Spaces, case and Unicode composition matter; no trimming or normalization occurs. Textareas normalize line endings to LF. Empty messages work; empty keys and unpaired Unicode surrogates are rejected. Hex keys need complete byte pairs with no prefix or spaces. Standard Base64 allows canonical padded or unpadded text, not URL-safe characters or whitespace.
Generate, copy, then verify.
Choose SHA-256, SHA-384 or SHA-512, enter a key and message, then generate Hex or Base64 output. To verify, select the signature encoding and paste the full MAC. Native Web Crypto verifies the bytes; malformed encodings return Input error, mismatches return Invalid. Truncated MACs are not supported. Sample loads public RFC 4231 test data, never a production secret.
Secret lifecycle and limits.
The key is masked by default. Optional secure randomness generates 32, 48 or 64 random bytes for the selected algorithm and selects Base64. Messages are limited to 128 KiB of UTF-8, keys to 4,096 encoded characters and signatures to 256 characters. No SHA-1 or custom cryptography is used. HTTPS or localhost is required. Editing discards results; Clear and leaving the page clear tool state. Cancel discards a pending result; native crypto itself cannot be aborted. JavaScript cannot guarantee memory zeroization. Explicit copying transfers data to your system clipboard, which the tool cannot clear for you.