Generate an HMAC authentication code for text or a file using a hexadecimal secret key.
Runs in your browser — your input is processed on this device and never uploaded.
Results appear here.
An HMAC is a message authentication code: a tag computed from your data and a secret key that proves both who produced the message and that it has not changed. Anyone can hash data, but only a holder of the key can produce a valid HMAC over it.
Enter the secret key as hexadecimal, supply text or a file, and pick an algorithm. SHA-256 is the default and the best choice for interoperability, with SHA-384, SHA-512, SHA3-256, and SHA3-512 also available. The result is the tag in hexadecimal, plus the algorithm used.
Because the obvious construction is broken. Hashing a secret followed by a message and publishing the result lets an attacker append data and compute a valid tag for the longer message without ever knowing the key, using the length-extension property of SHA-256 and SHA-512.
HMAC is the fix. It nests two hash operations with the key mixed in differently each time, which closes that hole and does so for any underlying hash. That is why the standard construction is worth using rather than inventing your own.
HMAC Verifier is the other half of this pair, for checking a tag rather than producing one.
If you need confidentiality as well as authenticity, an HMAC alone is the wrong shape: use Authenticated Encryption, which does both in one operation and is harder to combine incorrectly. If you need to prove authorship to someone who does not share your key, no MAC can do that, because verification requires the same secret.
Verification needs the key, the message, and the algorithm to match exactly. Changing any of the three produces a completely different tag, and a mismatch tells you nothing about which one was wrong.
Keep the key secret. An HMAC authenticates data without concealing it, so the message travels in the clear and anyone can read it. What they cannot do is alter it undetected.
Find similar tools by category or tag.