Ir para o conteúdo
HMAC

Gerador de HMAC

Assinaturas HMAC-SHA-256 / SHA-512 via Web Crypto.

Roda no navegador — os dados não saem do seu dispositivo

HMAC signs a message with a shared secret for integrity. Computed in-browser via Web Crypto (HMAC-SHA-256 / SHA-512)—key and message never leave your device.

Sobre Gerador de HMAC

HMAC (Hash-based Message Authentication Code) authenticates a message with a shared secret—common for webhooks, API request signing, and debugging HS* JWTs. toco.tools computes HMAC-SHA-256 and HMAC-SHA-512 via the Web Crypto SubtleCrypto API entirely in your browser. Keys and messages accept UTF-8 or hex bytes; output is hex (lower/upper) or Base64, with optional verify against an expected value. Secrets never leave the device. In production verification, use constant-time compares and protect your keys.

Como usar

  1. Choose SHA-256 or SHA-512
  2. Enter secret key and message
  3. Copy the HMAC or verify against an expected value

Perguntas frequentes

How does HMAC differ from a plain hash?

A hash digests data alone. HMAC mixes in a shared secret so only parties who know the key can produce the same signature.

Are the key or message sent to a server?

No. Everything is computed in your browser with Web Crypto.

Can I use an empty key?

No. Major browsers reject zero-length HMAC keys in Web Crypto—provide at least one byte.