Advertisement
Guide
About the HMAC Generator
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature that proves two things at once: that a message hasn't been altered (integrity) and that it came from someone who knows the shared secret (authenticity). It's the mechanism behind webhook signatures, API request signing, and the HS256 family of JWT signatures.
This tool computes an HMAC over your message using a secret key and your chosen hash algorithm, and can also verify an existing HMAC. It uses the browser's native Web Crypto API, so signing is fast and your keys never leave the page.
HMAC vs. a plain hash
A plain hash (like SHA-256) only proves integrity — but anyone can recompute it, so it doesn't prove whoproduced the message. Because HMAC mixes in a secret key, only parties holding that key can generate or verify a valid code. That's why webhook providers sign payloads with HMAC: you recompute the HMAC on your end with the shared secret and compare, confirming the request genuinely came from them.
Verify in constant time
When you check an incoming HMAC on a server, compare it using a constant-time comparison rather than a normal string equality check. A naive comparison can leak timing information that helps an attacker guess the signature byte by byte. This tool verifies locally for convenience; in production code, use your platform's timing-safe compare function.
How to use it
- 1Enter the message you want to sign.
- 2Enter the shared secret key.
- 3Pick the hash algorithm (SHA-256 is the common default).
- 4Copy the resulting HMAC, or paste an existing one to verify it matches.
Frequently asked questions
What is HMAC used for?
Verifying webhook payloads, signing API requests, and generating HS256/384/512 JWT signatures. Anywhere you need to confirm a message is unchanged and came from a party holding a shared secret.
What is the difference between HMAC and a digital signature?
HMAC uses one shared symmetric secret, so anyone who can verify can also sign. A digital signature (like RSA or ECDSA) uses a private key to sign and a public key to verify, so verifiers cannot forge signatures.
Which hash should I use with HMAC?
HMAC-SHA256 is the standard default and is widely supported. SHA-384 and SHA-512 offer longer output; choose whichever your integration specifies.
Is HMAC-SHA1 secure?
HMAC remains secure even when built on SHA-1 for authentication purposes, but SHA-256 is the recommended modern default for new systems.
Does my secret key leave my browser?
No. The HMAC is computed locally with the Web Crypto API — the message and key are never transmitted.