Online HMAC Calculator

Report a Problem
Message Encoding Calculated locally in your browser; no data is uploaded
Common Signature Examples
Key Encoding Length
Generated using the browser CSPRNG (crypto.getRandomValues)
Hash Algorithm Output Format
Verification uses a constant-time comparison to reduce information leakage from timing differences
Output length depends on the selected hash algorithm

Calculation Details

Algorithm：-
Digest Length：-
Output：-
Message Length：-
Key Length：-
Calculation Engine：-
Duration：-
Processing Location：-
HMAC uses a secret key during calculation and can verify both data integrity and message authenticity.
Note: JWT signatures use Base64URL (without padding, with -_ instead of +/), which differs from standard Base64. Pay attention to encoding differences when comparing values.
Privacy Notice：All calculations are performed locally in your browser. Your input and files are never uploaded to any server.

Generate and verify HMAC with 8 hash algorithms, three key/message encodings, and constant-time comparison

Online HMAC Calculator

HMAC is a keyed hash-based message authentication code. Different keys produce different results for the same message. HMAC can verify data integrity while confirming that the sender possesses the expected secret key, making it widely used for API signatures, Webhook verification, and signed download URLs.

Core Functions

  • Generate HMAC: Enter a key and message to calculate the HMAC result.
  • Verify HMAC: Paste an expected HMAC and compare it with the calculated value.
  • Random key generation: Use browser secure random generation to create 16-, 32-, or 64-byte test keys.
  • Key visibility: Show or hide the key while testing.
  • Examples: Built-in API signature and Webhook verification examples are provided.

Algorithms and Encoding

Eight algorithms are supported: HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512, HMAC-SHA3-224, HMAC-SHA3-256, HMAC-SHA3-384, and HMAC-SHA3-512. SHA-1 is marked as not recommended, while SHA-256 is the default. Keys and messages can independently use UTF-8, Hex, or Base64 encoding. Results support Hex and Base64 output.

Verification and Comparison

Verification uses constant-time comparison. Results display digest length, message length, and key length. JWT Base64URL encoding differs from standard Base64 in padding and two characters, so the encoding format must be selected correctly.

Error Handling

Invalid Hex characters or odd-length Hex values, invalid Base64 data, empty keys or messages, and missing expected HMAC values are reported clearly.

Use Cases

Useful for API signature debugging, Webhook verification, cross-language testing with PHP, Java, Go, and Node.js, and testing with randomly generated keys.

Privacy and Data Security

All calculations are performed locally in the browser. Keys and messages are not uploaded to a server. Use test keys rather than production secrets during debugging.

Online HMAC generation and verification

HMAC introduces a secret key into hash calculation to verify data integrity and confirm message origin. It is commonly used for API signatures and Webhook verification.
  • Supports 8 algorithms: HMAC-SHA1, SHA256, SHA384, SHA512, and SHA3-224/256/384/512
  • Keys and messages can independently be parsed as UTF-8, Hex, or Base64 for compatibility with different API specifications
  • Hex and Base64 output with digest, message, and key length information
  • Generate 16-, 32-, or 64-byte keys using browser secure random numbers, with show and hide controls
  • Verification mode compares a pasted expected HMAC using constant-time comparison
  • Built-in API signature and Webhook verification examples, with a warning about JWT Base64URL encoding differences
Suitable for API signature debugging, Webhook verification, and cross-language signature comparison. Encoding failures are reported directly. All calculations are completed locally in the browser, and keys and messages are not uploaded to the server.
Similar tools
Comments 0
No comments yet. Be the first to comment!
avatar
Comment content cannot be empty
0/255