HMAC Generator (SHA-256 / SHA-512)
Keyed message authentication codes.
Free · no sign-up · runs locally·
About this tool
An HMAC binds a message to a secret key: anyone with the key can verify both integrity and authenticity. It is the signature scheme behind webhook verification (Stripe, GitHub), AWS request signing, and HS256 JWTs.
Enter your key as text or hex, choose a hash, and the MAC updates live. Computation uses the Web Crypto API locally.
Like everything on encrypt.tools, this runs entirely in your browser — nothing you enter is transmitted or stored.
Do the same in a terminal
Reproduce or cross-check this tool with standard command-line utilities. For deterministic operations like hashing and encoding, the output matches exactly.
$ printf 'hello' | openssl dgst -sha256 -hmac 'secret'
SHA2-256(stdin)= 88aab3ede8d3adf94d26ab90d3bafd4a2083070c3bcce9c014ee04a443847c0bFrequently asked questions about HMAC Generator
What is HMAC used for?+
HMAC proves a message came from someone holding a shared secret key and wasn't altered. It backs webhook signatures (Stripe, GitHub), AWS request signing, and HS256 JWTs.
How is HMAC different from a plain hash?+
A plain hash anyone can compute. HMAC mixes in a secret key, so only parties who know the key can produce or verify the code — giving authenticity, not just integrity.
Can I use a hex key?+
Yes — choose the hex key format to supply binary key material, or use text for a passphrase-style secret.
Encoding vs Encryption vs Hashing: The Difference, With Examples
Encoding, encryption and hashing all turn data into gibberish, but only one keeps secrets. Learn the difference with real Base64, AES and SHA-256 examples and when to use each.
6 MIN READSYMMETRIC · AESAES-GCM vs CBC vs CTR vs ECB: Which AES Mode Should You Use?
AES is only as safe as its mode. Compare ECB, CBC, CTR and GCM — how each works, how each fails, and why AES-GCM (or ChaCha20-Poly1305) is the right default in 2026.
7 MIN READHASHING · SECURITYIs MD5 Still Safe? When MD5 and SHA-1 Are (and Aren't) OK to Use
MD5 and SHA-1 are broken — but not for everything. Learn exactly which attacks exist, where MD5 and SHA-1 are still acceptable, where they are dangerous, and what to use instead.
5 MIN READJWT · WEB SECURITYHow to Decode a JWT — and 7 Security Mistakes That Get Tokens Forged
What's inside a JSON Web Token, how to decode and verify one safely, and the real-world JWT vulnerabilities — alg:none, key confusion, weak secrets — with the fix for each.
6 MIN READRelated tools
SHA Hash Generator
Every SHA digest of your text, computed live
MD5 · 128-BITMD5 Generator
Legacy MD5 digests for checksums and lookups
CRC · 8/16/32CRC Checksum
Cyclic redundancy checks for data integrity
FILE · SHA/MD5File Checksum
Drag a file, get its hashes, compare against a published sum