HMAC Keyed-Hash Generator
HMAC Keyed-Hash Generator: Computes keyed-hash message authentication code using Web Crypto SubtleCrypto.sign with HMAC algorithm.
About this hmac keyed-hash generator
Computes keyed-hash message authentication code using Web Crypto SubtleCrypto.sign with HMAC algorithm Runs entirely in-memory using Web Crypto primitives to keep sensitive tokens, certificates, and cryptographic keys secure from third-party interception.
Encoding & cryptographic principles
Computes cryptographically secure message digests and file integrity checksums in compliance with NIST FIPS 180-4 (Secure Hash Standard: SHA-1, SHA-224, SHA-256, SHA-384, SHA-512), FIPS 202 (SHA-3 / Keccak), RFC 1321 (MD5), and CRC-32 (ISO 3309). Hash calculations execute via native Web Crypto APIs (`window.crypto.subtle.digest`) and verified constant-time JavaScript implementations (`@noble/hashes`), guaranteeing resistance to length-extension and collision vulnerabilities in SHA-2/SHA-3 modes.
Worked verification example
Scenario: Create an HMAC-SHA-256 for a known local message and secret.
Sample input:
Processing: Uses browser Web Crypto with the supplied message, secret, and supported SHA algorithm; HMAC-MD5 is unavailable.
Illustrative output:
Security parameters & input constraints
The default hash is SHA-256 and the default secret is the literal text secret. This is not an HTTP request signer or verifier; it does not canonicalize requests or support HMAC-MD5. The secret is text, not a binary-key input. An empty secret uses a one-byte zero key to match HMAC's padded empty-key block.
Cryptographic digests, encoded strings, and signatures generated by HMAC Keyed-Hash Generator should be verified against target authentication systems before production use.
Client-side Web Crypto boundary
Key derivation, hashing, and encoding in HMAC Keyed-Hash Generator execute in local memory using Web Crypto APIs without remote socket transmission.
Cryptographic specifications & RFC standards
Technical specifications and cryptographic RFC standards governing algorithms and key representations:
- RFC 2104 (HMAC: Keyed-Hashing for Message Authentication)
- NIST FIPS 198-1
HMAC Keyed-Hash Generator verification · Audit standards
How to use it
- Enter a message, secret and browser-supported hash in JSON, or enter plain text for the message with defaults.
- Encode the message and secret as UTF-8 and sign with Web Crypto HMAC.
- Display the lowercase hexadecimal MAC.
Frequently asked questions
How are HMAC JSON defaults and empty fields handled?+
Whitespace before a JSON object is accepted. A missing or empty `algorithm` uses `SHA-256`; a missing `secret` uses `secret`; and a missing JSON `message` uses `CZOA`. Explicit empty `secret` and `message` remain empty.
How can I reproduce the SHA-256 reference HMAC?+
Enter `{ "message": "The quick brown fox jumps over the lazy dog", "secret": "key", "algorithm": "SHA-256" }`. The hexadecimal result is `f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8`.
What does an HMAC prove?+
With a shared secret, an HMAC checks message integrity and authenticity. Both parties must use the same exact bytes, algorithm, and secret.
Does it implement a webhook protocol?+
No. It signs the supplied strings only. Canonicalization, timestamps, nonces, replay protection, headers, and remote verification are the caller’s responsibility.