مولّد HMAC

An HMAC generator that signs a message with a secret key using SHA-1, SHA-256, SHA-384 or SHA-512, and shows the result as a hex digest. Pick an algorithm, enter the key and the message, and copy the signature.

HMAC stands for hash-based message authentication code. It is a keyed hash: combining a secret key with the message proves two things at once, that the message was created by someone who holds the key, and that it has not been altered in transit.

The difference from a plain hash is the key. Anyone can compute a SHA-256 of a message, but only someone with the shared secret can produce the correct HMAC, which is what turns a checksum into proof of authenticity.

That is why it is everywhere in web infrastructure. Webhooks from services like Stripe, GitHub and Slack sign each request with an HMAC so your server can verify the call really came from them, and many APIs sign requests the same way.

SHA-256 is the common default; SHA-384 and SHA-512 are stronger, while SHA-1 is legacy and best avoided for new systems.

It runs locally with the Web Crypto API, so your key and message are never uploaded, which is important since the key is a secret.