HMAC Generator

Common HMAC uses

• API request signing — AWS Signature v4 (HMAC-SHA256), GitHub webhooks (HMAC-SHA256), Stripe (HMAC-SHA256)
• JWT signing — HS256 = HMAC-SHA256, HS384 = HMAC-SHA384, HS512 = HMAC-SHA512
• TLS — record MAC for legacy cipher suites
• PBKDF2 + HKDF — both use HMAC internally as a pseudo-random function

Algorithm picker cheatsheet

• HMAC-SHA1 — only when an old spec requires it. Considered deprecated for new systems since 2017.
• HMAC-SHA256 — modern default. Used by AWS, Stripe, GitHub, Square, almost every API.
• HMAC-SHA384 / SHA-512 — only when an explicit spec or compliance requirement demands it. SHA-256 is fine for nearly all use cases.

Privacy

HMAC computation uses the browser's SubtleCrypto API. The key and message never leave your browser.