# HMAC Generator

URL: https://phishdestroy.io/developer-tools/hmac-generator
Category: General dev
Where it runs: Runs locally (nothing you enter is uploaded)

Compute an HMAC-SHA-256 or HMAC-SHA-512 of a message with a secret key, in hex or Base64, for example to check a webhook or API request signature.

## Example input

Published test vector

```
The quick brown fox jumps over the lazy dog
```

With the key "key", HMAC-SHA-256 of this sentence is f7bc83f4…2d1a3cd8 (64 hex characters), the published test value from the HMAC Wikipedia article and many test suites.

## FAQ

### What exactly does it compute?

An HMAC (RFC 2104) with SHA-256 or SHA-512 over the UTF-8 bytes of the message, with the key taken as UTF-8 text, shown as hex or Base64. A hex or Base64 secret is not decoded first, so it will not match services that expect the raw key bytes.

### Why do I get no result, or a different one?

Generate does nothing while the key or the message is empty. An extra space or line break in the message, or a differently encoded key, changes the result completely.

### Is my key sent anywhere?

No. The HMAC is computed in your browser with the Web Crypto API; the key and the message are not uploaded or stored.

## Related tools

- [Text Hash Generator](https://phishdestroy.io/developer-tools/hash-generator)
- [JWT Generator (HS256)](https://phishdestroy.io/developer-tools/jwt-generator)
- [JWT Decoder](https://phishdestroy.io/developer-tools/jwt-decoder)
- [API Key & Token Generator](https://phishdestroy.io/developer-tools/api-token-generator)
- [AES-GCM Encrypt / Decrypt](https://phishdestroy.io/developer-tools/aes-gcm-encryption)

All tools: https://phishdestroy.io/developer-tools