What is HMAC used for?

HMAC binds a message to a shared secret key so the receiver can verify both integrity and authenticity. It is widely used to sign API requests, verify webhook payloads (Stripe, GitHub, Slack) and protect tokens.

How is HMAC different from a plain hash?

A plain hash like SHA-256 can be computed by anyone, so it only proves integrity. HMAC mixes in a secret key, so only parties who know the key can produce or verify the same value.

Is my secret key uploaded anywhere?

No. The key and message never leave your browser — the HMAC is computed locally with the Web Crypto API.

HMAC Generator — Gera Tools

HMAC generator — SHA-256, SHA-384 and SHA-512

A HMAC (Hash-based Message Authentication Code, RFC 2104) combines a secret key with your message to produce a keyed hash. Anyone who knows the key can recompute the same value, which proves the message was not tampered with and came from someone holding the key.

Pick an algorithm, enter your secret key and message, and the hex HMAC appears instantly. The most common choice for signing API requests and verifying webhooks is HMAC-SHA-256.

Everything runs locally in your browser via the Web Crypto API — your key and payload are never sent over the network.