HMAC Generator
Sign any message with a secret key using HMAC-SHA256, 384 or 512. Not the same as TokenSmith's JWT check — this signs plain text on its own.
Data
HMAC signature
—
How HMAC signing works
HMAC (Hash-based Message Authentication Code, RFC 2104) combines a cryptographic hash function with a secret key so that only someone who knows the key can produce a valid signature for a given message:
message: "The quick brown fox jumps over the lazy dog" secret: "key" HMAC-SHA256 = f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
A plain hash (SHA-256 alone) only proves a message wasn't altered — anyone can recompute it. HMAC additionally proves authenticity: the sender must have known the shared secret. It's also structurally resistant to length-extension attacks that affect naive uses of Merkle–Damgård hashes like SHA-256 on their own. This tool computes the signature with the browser's native crypto.subtle.importKey() / crypto.subtle.sign() (Web Cryptography API) — no external libraries, no server calls.
Frequently asked questions
Is my secret key sent to any server?
No. The signature is computed with the browser's native SubtleCrypto API; the message and secret never leave your machine.
How is HMAC different from a plain hash like SHA-256?
A plain hash proves data wasn't altered, but anyone can compute it. HMAC mixes in a secret key per RFC 2104, so only someone who knows the key can produce a valid signature — it proves both integrity and authenticity, and resists length-extension attacks that affect bare hashes.
Which algorithms are supported?
HMAC-SHA256, HMAC-SHA384 and HMAC-SHA512, all computed with the Web Cryptography API's crypto.subtle.sign().
Is this the same as TokenSmith's JWT signature check?
No. TokenSmith verifies or generates a full JWT (header.payload.signature). This tool signs any arbitrary text with HMAC on its own — useful for webhook signatures, API request signing, or checking a vendor's HMAC example against your own implementation.