SECURITY WORKSPACE
HMAC Generator
Generate an HMAC-SHA256 or SHA512 digest from a message and test key.
Input is processed on this site only when you run the tool. The application does not save inputs or results.
Use a test key. Message and key are sent to this server. Generation does not verify a webhook signature.
message.txt
key.txt
Result result.txt
A little clarity goes here.
Run the tool to see your result.
Result preview
UTF-8 text, at most 65536 bytes per input. Tab leaves the editor. Plain text disables syntax colors. Browser textareas may normalize line endings to LF.
{"generate":{"inputMode":"pair","options":{"algorithm":{"type":"enum","values":["sha256","sha512"],"default":"sha256"},"encoding":{"type":"enum","values":["hex","base64"],"default":"hex"}},"inputLabels":{"input":"Message","input2":"Secret key (single line)"},"inputLimits":{"input":65536,"input2":4096}}}{"generate":{"input":"what do ya want for nothing?","input2":"Jefe","options":{"algorithm":"sha256","encoding":"hex"}}}A QUICK WALKTHROUGH
A familiar workflow,
with room to focus.
Enter a message and a fictional or test secret key. Show key reveals only the current field.
Choose SHA-256 or SHA-512 and hexadecimal or padded Base64, then Generate.
Copy the digest for your test integration, using the same exact message bytes and key encoding.
When to use HMAC Generator
Reproduce a message authentication digest with a fictional key while developing a signed API integration.
Read the result
The output is a digest of the exact supplied UTF-8 message and key. Both go to the server. A generated digest alone does not verify a webhook, prevent replays or authenticate a user.
SEE IT IN PRACTICE
Worked examples
Sample input. A result you can inspect.
Generate example
Message
what do ya want for nothing?
Secret key (single line)
Jefe
- Algorithm
- SHA-256
- Representation
- Hexadecimal
Expected result
5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843
Formats, limits and common errors
Supply a nonempty single-line key. Match the message, key encoding, algorithm and output representation required by your integration.
- Both message and key are sent to this site's server. The application does not save them, but hosting visibility still matters. Use test data rather than production credentials.
- The key is 1–4,096 UTF-8 bytes on one line. It is literal UTF-8 text, not decoded hex or Base64. The message can be empty and is at most 64 KiB.
- No trimming or Unicode normalization. A space or newline changes the digest. Browser textareas may normalize message line endings to LF.
- Generation only: no signature comparison, webhook receiving, replay protection or account authentication. Provider header and payload conventions are separate requirements.
- Input ceiling: 65,536 UTF-8 bytes; individual fields may have narrower limits shown above. Output: at most 256 UTF-8 bytes; serialized responses have a separate 1 MiB ceiling. Size/work failures return no partial result.