HMAC-SHA384 Generator
Generate an HMAC-SHA384 signature from a message and a secret key, instantly inside your browser.
What is HMAC-SHA384?
HMAC-SHA384 combines a message with a secret key through the SHA-384 hash function to produce a signature that proves both the message's integrity and that it was created by someone who knows the secret key. Unlike a plain hash, it can't be reproduced without the key, which makes it useful for verifying API requests, webhook payloads, and signed tokens where a larger digest size is required.
This tool computes an HMAC using SHA-384 as the underlying hash function, using the browser's native Web Crypto API entirely on your device.
GuideHow to use it
How the signature is calculated
Both the message and secret key are read as UTF-8 bytes, and the secret key is imported as an HMAC key using the browser's Web Crypto API with the selected hash function. The API then signs the message with that key, producing a signature that's displayed as hexadecimal or Base64. The same message and key will always produce the same signature, and even a tiny change to either one produces a completely different result.
Why it helpsFeatures & benefits
Why this runs entirely in your browser
A secret key is sensitive by nature, so this tool never sends it anywhere — the HMAC signature is computed natively by the browser's Web Crypto API locally in the tab, and nothing typed here is logged or stored.
Common uses
Verifying a webhook payload's signature matches what a service sent, signing an API request the way a provider like AWS or Stripe expects, or generating a signed token for a custom authentication scheme.
Frequently asked questions
A few things people usually want to know before trusting the numbers.
A regular hash only depends on the input. HMAC also depends on a secret key, so only someone who knows that key can produce a matching signature — which is what makes it useful for authentication, not just integrity checking.
Use SHA-384 when a specific API or spec requires it, or when you want a larger digest size than SHA-256 provides without the full length of SHA-512.
Yes, indirectly — generate the HMAC for your message and secret key, then compare it to the signature you received. If they match exactly, the signature is valid.
Yes. Clicking a different algorithm switches the page while keeping the message and secret key you've already entered.
No. All signing happens locally in your browser via the Web Crypto API. Nothing typed here is sent to a server, stored, or shared.