Free · Private · Client-side

HMAC Secret Generator

Generate secure secrets for HMAC (Hash-based Message Authentication Code). Used to verify data integrity and authenticity.

Generated values never leave this device.

Hash Algorithm

Format

Estimated entropy: 256 bits · 32 random bytes~132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe to crack

Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 132,943,112,026,157,700,000,000,000,000,000,000 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated secrets

Strong256 bits

Usage Examples

Node.js

const crypto = require('crypto');

const secret = '...';
const message = 'Data to authenticate';

const hmac = crypto.createHmac('sha256', Buffer.from(secret, 'base64'));
hmac.update(message);
const signature = hmac.digest('hex');

console.log(signature);

Python

import hmac
import hashlib
import base64

secret = base64.b64decode('...')
message = b'Data to authenticate'

signature = hmac.new(secret, message, hashlib.sha256).hexdigest()
print(signature)

Bulk Generation

Generatesecrets

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to provide both data integrity and authenticity verification. It's faster than digital signatures while ensuring only someone with the secret key could have created the hash.

🔐 Authentication

Verifies message authenticity. Only someone with the secret key can generate valid HMACs, preventing impersonation attacks.

✅ Integrity

Detects any data tampering. Even single-bit changes will result in completely different HMAC values.

🚀 Performance

Much faster than RSA signatures while providing similar security when both parties share the secret key.

HMAC Applications

🔐 API Security

JWT Signing: HS256 algorithm for JSON Web Tokens
Webhook Verification: GitHub, Stripe signatures
Request Signing: API request authenticity
OAuth 1.0: Request parameter signing

🌐 Web Security

Session Tokens: Tamper-proof identifiers
CSRF Protection: Anti-forgery tokens
Cookie Signing: Prevent tampering
Password Reset: Secure reset tokens

Implementation Examples

Node.js HMAC

hmac-node.js

const crypto = require('crypto');

// Generate secret (store securely!)
const secret = crypto.randomBytes(32);

// Create HMAC
function createHMAC(message, secret) {
  return crypto.createHmac('sha256', secret)
    .update(message)
    .digest('hex');
}

// Verify HMAC (timing-safe)
function verifyHMAC(message, signature, secret) {
  const expected = createHMAC(message, secret);
  return crypto.timingSafeEqual(
    Buffer.from(signature, 'hex'),
    Buffer.from(expected, 'hex')
  );
}

// Usage
const message = '{"user":"john","amount":100}';
const hmac = createHMAC(message, secret);
const valid = verifyHMAC(message, hmac, secret);

console.log('HMAC:', hmac);
console.log('Valid:', valid);

Python HMAC

hmac-python.py

import hmac
import hashlib
import secrets

# Generate secret
secret = secrets.token_bytes(32)

# Create HMAC
def create_hmac(message, secret):
    return hmac.new(
        secret,
        message.encode('utf-8'),
        hashlib.sha256
    ).hexdigest()

# Verify HMAC
def verify_hmac(message, signature, secret):
    expected = create_hmac(message, secret)
    return hmac.compare_digest(signature, expected)

# Usage
message = "Hello HMAC!"
signature = create_hmac(message, secret)
is_valid = verify_hmac(message, signature, secret)

print(f"HMAC: {signature}")
print(f"Valid: {is_valid}")

Generate in Terminal

OpenSSL (base64)

$openssl rand -base64 32

OpenSSL (hex)

$openssl rand -hex 32

Python

$python3 -c "import secrets; print(secrets.token_urlsafe(32))"

When to use HMAC

Verifying API request signatures (e.g., webhooks)
Creating secure session tokens
Authenticating messages between services
Implementing signed URLs