Free · Private · Client-side

HMAC Secret Generator

Generate secure secrets for HMAC (Hash-based Message Authentication Code). Used to verify data integrity and authenticity.

Generated values never leave this device.

Hash Algorithm

Format

Estimated entropy: 256 bits · 32 random bytes~132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe to crack

Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 132,943,112,026,157,700,000,000,000,000,000,000 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated secrets

Strong256 bits

Usage Examples

Node.js

const crypto = require('crypto');

const secret = '...';
const message = 'Data to authenticate';

const hmac = crypto.createHmac('sha256', Buffer.from(secret, 'base64'));
hmac.update(message);
const signature = hmac.digest('hex');

console.log(signature);

Python

import hmac
import hashlib
import base64

secret = base64.b64decode('...')
message = b'Data to authenticate'

signature = hmac.new(secret, message, hashlib.sha256).hexdigest()
print(signature)

Bulk Generation

Generatesecrets

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to provide both data integrity and authenticity verification. It's faster than digital signatures while ensuring only someone with the secret key could have created the hash.

For an unkeyed hash of text or a file instead of an HMAC secret, use the SHA-256 hash generator.

🔐 Authentication

Verifies message authenticity. Only someone with the secret key can generate valid HMACs, preventing impersonation attacks.

✅ Integrity

Detects any data tampering. Even single-bit changes will result in completely different HMAC values.

🚀 Performance

Much faster than RSA signatures while providing similar security when both parties share the secret key.

HMAC Applications

🔐 API Security

JWT Signing: HS256 algorithm for JSON Web Tokens
Webhook Verification: GitHub, Stripe signatures
Request Signing: API request authenticity
OAuth 1.0: Request parameter signing

🌐 Web Security

Session Tokens: Tamper-proof identifiers
CSRF Protection: Anti-forgery tokens
Cookie Signing: Prevent tampering
Password Reset: Secure reset tokens

Implementation Examples

Node.js HMAC

hmac-node.js

const crypto = require('crypto');

// Generate secret (store securely!)
const secret = crypto.randomBytes(32);

// Create HMAC
function createHMAC(message, secret) {
  return crypto.createHmac('sha256', secret)
    .update(message)
    .digest('hex');
}

// Verify HMAC (timing-safe)
function verifyHMAC(message, signature, secret) {
  const expected = createHMAC(message, secret);
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

// Usage
const message = '{"user":"john","amount":100}';
const hmac = createHMAC(message, secret);
const valid = verifyHMAC(message, hmac, secret);

console.log('HMAC:', hmac);
console.log('Valid:', valid);

Python HMAC

hmac-python.py

import hmac
import hashlib
import secrets

# Generate secret
secret = secrets.token_bytes(32)

# Create HMAC
def create_hmac(message, secret):
    return hmac.new(
        secret,
        message.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

# Verify HMAC
def verify_hmac(message, signature, secret):
    expected = create_hmac(message, secret)
    return hmac.compare_digest(signature, expected)

# Usage
message = "Hello HMAC!"
signature = create_hmac(message, secret)
is_valid = verify_hmac(message, signature, secret)

print(f"HMAC: {signature}")
print(f"Valid: {is_valid}")

Generate in Terminal

OpenSSL (base64)

$openssl rand -base64 32

OpenSSL (hex)

$openssl rand -hex 32

Python

$python3 -c "import secrets; print(secrets.token_urlsafe(32))"

When to use HMAC

Verifying API request signatures (e.g., webhooks)
Creating secure session tokens
Authenticating messages between services
Implementing signed URLs