Skip to content
HMAC

HMAC Generator

HMAC-SHA-256 / SHA-512 signatures via Web Crypto.

Runs in your browser — data never leaves your device

HMAC signs a message with a shared secret for integrity. Computed in-browser via Web Crypto (HMAC-SHA-256 / SHA-512)—key and message never leave your device.

About HMAC Generator

HMAC (Hash-based Message Authentication Code) authenticates a message with a shared secret—common for webhooks, API request signing, and debugging HS* JWTs. toco.tools computes HMAC-SHA-256 and HMAC-SHA-512 via the Web Crypto SubtleCrypto API entirely in your browser. Keys and messages accept UTF-8 or hex bytes; output is hex (lower/upper) or Base64, with optional verify against an expected value. Secrets never leave the device. In production verification, use constant-time compares and protect your keys.

How to use

  1. Choose SHA-256 or SHA-512
  2. Enter secret key and message
  3. Copy the HMAC or verify against an expected value

FAQ

How does HMAC differ from a plain hash?

A hash digests data alone. HMAC mixes in a shared secret so only parties who know the key can produce the same signature.

Are the key or message sent to a server?

No. Everything is computed in your browser with Web Crypto.

Can I use an empty key?

No. Major browsers reject zero-length HMAC keys in Web Crypto—provide at least one byte.