HMAC generator
Generate HMAC (Hash-based Message Authentication Code)
Configuration
HMAC updates when you change message, secret key, or algorithm
HMAC result
Hash-based message authentication code
TL;DR
What is HMAC generator?
HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the integrity and authenticity of a message using a shared secret key and a hash function (typically SHA-256 or SHA-512). Unlike a plain hash, an HMAC cannot be reproduced without knowing the secret key, so it proves the message came from a trusted sender.
How it works
HMAC applies the hash function twice: once with the key XORed with an inner padding constant, and once with the key XORed with an outer padding constant, wrapping the inner hash. This construction (defined in RFC 2104) prevents length-extension attacks that affect plain SHA hashes.
Common use cases
- ‣Webhook verification: sign webhook payloads so receivers can confirm the request came from the expected sender
- ‣API request signing: attach an HMAC signature to API requests to prevent tampering in transit
- ‣JWT signatures: HS256 and HS512 JWT signing algorithms use HMAC-SHA256 and HMAC-SHA512
- ‣Cookie integrity: sign cookie values to detect client-side tampering
Frequently asked questions
What is the difference between HMAC and a plain hash?
A plain hash (SHA-256, MD5) takes only the message as input. Anyone can compute it. HMAC takes both the message and a secret key; without the key, you cannot produce a valid HMAC. This makes HMAC suitable for authentication, whereas a plain hash is only suitable for integrity checking.
Which algorithm should I use: HMAC-SHA1, HMAC-SHA256, or HMAC-SHA512?
Use HMAC-SHA256 as the default. HMAC-SHA1 is still structurally sound for MAC use (unlike plain SHA-1) but SHA-256 is preferred for new systems. Use HMAC-SHA512 when you need a larger output or are operating on 64-bit hardware where SHA-512 can be faster than SHA-256.
See also
- ‣JWT decoder: HS256 and HS512 JWT signing algorithms use HMAC-SHA256 and HMAC-SHA512 respectively. Decode a JWT to inspect which algorithm its header declares
- ‣Hash text: for cases where authentication is not required and you only need a checksum, a plain SHA-256 hash is simpler and does not require a shared secret