HMAC Generator
Generate HMAC authentication tags for UTF-8 messages with SHA-256, SHA-384, or SHA-512.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Avoid live production secrets; use dummy or masked data where possible. Data handling details
How it works
HMAC combines a message with a secret key using a hash algorithm. The message is encoded as UTF-8. The key is UTF-8 text by default, or raw bytes written as hexadecimal or Base64 for keys that were generated as bytes, such as RFC 4231 test vectors or a Base64 shared secret from a config file. Hex keys are pairs of digits; ASCII space, tab, CR, or LF may separate pairs but not split one, and there is no 0x prefix. Base64 keys use one alphabet, standard (+ /) or URL-safe (- _), never both in one key; padding is optional, ASCII space, tab, CR, or LF anywhere between characters is ignored, and any other whitespace or character is rejected. Everything is processed by the browser Web Crypto API. This tool does not verify a received tag or make a security judgment; compare tags with a constant-time API in your application.Input and secret are limited to 1 MiB each and never leave this browser.