Saltar al contenido
HMAC

Generador HMAC

Firmas HMAC-SHA-256 / SHA-512 con Web Crypto.

Se ejecuta en tu navegador — los datos no salen de tu dispositivo

HMAC signs a message with a shared secret for integrity. Computed in-browser via Web Crypto (HMAC-SHA-256 / SHA-512)—key and message never leave your device.

Acerca de Generador HMAC

HMAC (Hash-based Message Authentication Code) authenticates a message with a shared secret—common for webhooks, API request signing, and debugging HS* JWTs. toco.tools computes HMAC-SHA-256 and HMAC-SHA-512 via the Web Crypto SubtleCrypto API entirely in your browser. Keys and messages accept UTF-8 or hex bytes; output is hex (lower/upper) or Base64, with optional verify against an expected value. Secrets never leave the device. In production verification, use constant-time compares and protect your keys.

Cómo usarla

  1. Choose SHA-256 or SHA-512
  2. Enter secret key and message
  3. Copy the HMAC or verify against an expected value

Preguntas frecuentes

How does HMAC differ from a plain hash?

A hash digests data alone. HMAC mixes in a shared secret so only parties who know the key can produce the same signature.

Are the key or message sent to a server?

No. Everything is computed in your browser with Web Crypto.

Can I use an empty key?

No. Major browsers reject zero-length HMAC keys in Web Crypto—provide at least one byte.