HMAC Generator
Understand HMAC Generator
Computes an HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512 authentication code over a message using a shared secret key.
How it works
HMAC runs the hash twice with the key mixed into each pass, so producing a valid code requires holding the key. That is the difference from a plain hash: anyone can recompute a SHA-256 digest over modified data, which makes a bare digest useless against a deliberate change, while an HMAC binds integrity to possession of the secret. The output is the width of the underlying hash — 32 bytes for SHA-256, shown here as 64 hex characters. This tool treats the key as UTF-8 text and signs with WebCrypto.
When to use it
- Verifying a GitHub or Stripe webhook by recomputing the signature over the raw request body.
- Debugging an AWS Signature V4 or similar request-signing scheme when the server rejects your signature.
- Confirming that a signing implementation in another language produces byte-identical output.
- Building the signature segment of an HS256 JWT by hand to see how the pieces fit together.
- Deriving a deterministic, unforgeable token from a record id plus a server-side secret.
Watch out for
- Compare codes in constant time in real code. Using === or a plain string comparison exits early on the first differing byte, which leaks the correct prefix over many attempts; use crypto.timingSafeEqual, hmac.compare_digest, or your language equivalent.
- Sign the exact raw bytes. Parsing JSON and re-serializing it changes whitespace and key order, and the HMAC will not match. Capture the request body before any body-parsing middleware touches it.
- Encodings have to line up. This tool takes a UTF-8 text key and returns hex. A provider that publishes a base64 secret, or expects a base64 signature, needs an explicit conversion — mismatched encoding is the most common cause of a signature that "should" match.
- An HMAC proves origin and integrity, not freshness. Unless a timestamp or nonce is inside the signed data and checked, a captured request can be replayed unchanged and will verify.
Not the right tool for: Signatures that third parties should verify but not be able to produce. HMAC is symmetric — the verifying key is the signing key — so use an asymmetric algorithm such as RS256 or Ed25519 when the verifier must not be able to forge.
Frequently Asked Questions
What is a message authentication code?
A message authentication code (MAC) is a short value appended to a message to verify both its integrity (it wasn't changed) and authenticity (it came from the expected sender who holds the secret key). HMAC is the most widely used MAC construction — it combines a hash function with a secret key.
What is API authentication?
API authentication proves a client's identity to a server before granting access. HMAC is used in API signing schemes: the client computes HMAC over the request (method + path + body + timestamp) with a shared secret key and sends the result as a header. The server recomputes and compares.
What is HMAC SHA256?
HMAC-SHA256 applies SHA-256 as the hash function inside the HMAC construction. It produces a 256-bit (32-byte) authentication code. It is the most common choice for webhook signatures (GitHub, Stripe) and AWS Signature V4. HMAC-SHA512 produces a 512-bit code for higher security.
How to Use HMAC Generator
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.