What is HMAC and how does it work?

HMAC (Hash-based Message Authentication Code) is a cryptographic construction that combines a hash function with a secret key to produce an authentication code. It verifies both data integrity AND authenticity - only someone with the secret key can generate or verify the correct HMAC.

How do I generate an HMAC online?

Enter your message in the input field, provide your secret key, select the hash algorithm (SHA-256 recommended), and the HMAC is generated instantly. Copy the hexadecimal output for use in API authentication, message signing, or data verification.

How is HMAC different from a regular hash?

A regular hash (like SHA-256) only verifies data integrity - anyone can compute it. HMAC also verifies authenticity because only someone with the secret key can generate the correct HMAC. This prevents attackers from modifying data and recomputing the hash.

What hash algorithms can HMAC use?

HMAC can use any cryptographic hash function. Common choices: HMAC-SHA256 (recommended, most widely used), HMAC-SHA512 (maximum security), HMAC-SHA384, HMAC-SHA1 (deprecated but still in legacy systems), HMAC-MD5 (deprecated, avoid).

Where is HMAC used in real applications?

HMAC is used in: API authentication (AWS, Stripe, webhooks), JWT token signatures (HS256, HS512), OAuth 1.0, secure cookies, message authentication in protocols, webhook verification, API request signing, and data integrity verification.

Yes, HMAC is cryptographically secure when used with a secure hash function (SHA-256 or better) and a strong, random secret key. HMAC's security is proven mathematically - it's secure if the underlying hash function is secure.

What makes a good HMAC secret key?

A good HMAC key should be: at least as long as the hash output (32 bytes for SHA-256, 64 bytes for SHA-512), randomly generated using a cryptographic random number generator, kept secret and never transmitted with the message, and unique per application.

Can HMAC be reversed to find the key?

No, HMAC is based on one-way hash functions and cannot be reversed. You cannot recover the secret key or original message from an HMAC output. Brute-forcing a strong key is computationally infeasible.

What is the difference between HMAC and digital signatures?

HMAC uses symmetric keys - the same secret key for signing and verifying (both parties must share the key). Digital signatures use asymmetric keys - a private key signs, a public key verifies (only the signer needs the private key).

How do I verify an HMAC?

Compute the HMAC of the received message using the same secret key and algorithm, then compare it to the received HMAC. CRITICAL: Use constant-time comparison to prevent timing attacks. Never use simple string equality (==).

What is HMAC-SHA256 and why is it recommended?

HMAC-SHA256 uses SHA-256 as the underlying hash function, producing a 256-bit (64 char) authentication code. It's recommended because SHA-256 is secure, widely supported, fast, and provides sufficient security for virtually all applications.

How do I use HMAC for API authentication?

Typical flow: 1) Construct a canonical string from request data (method, path, timestamp, body), 2) Compute HMAC of this string with your secret key, 3) Include the HMAC in the Authorization header, 4) Server recomputes and compares.

What is the difference between HMAC and encryption?

HMAC provides authentication and integrity - it proves who sent the message and that it wasn't modified. Encryption provides confidentiality - it hides the message content. They serve different purposes and are often used together.

How do I use HMAC in programming?

Most languages have HMAC built-in: JavaScript (crypto.subtle.sign("HMAC")), Python (hmac.new()), PHP (hash_hmac()), Java (Mac.getInstance("HmacSHA256")), Node.js (crypto.createHmac()), Go (crypto/hmac).

Is my data secure when using this HMAC generator?

Yes! All HMAC generation happens 100% in your browser using JavaScript. Your message and secret key never leave your device or get uploaded to any server. This makes it safe for generating HMACs with production API keys.

What is HMAC and how does it work?

HMAC (Hash-based Message Authentication Code) is a cryptographic construction that combines a hash function with a secret key to produce an authentication code. It verifies both data integrity AND authenticity - only someone with the secret key can generate or verify the correct HMAC.

How do I generate an HMAC online?

Enter your message in the input field, provide your secret key, select the hash algorithm (SHA-256 recommended), and the HMAC is generated instantly. Copy the hexadecimal output for use in API authentication, message signing, or data verification.

How is HMAC different from a regular hash?

A regular hash (like SHA-256) only verifies data integrity - anyone can compute it. HMAC also verifies authenticity because only someone with the secret key can generate the correct HMAC. This prevents attackers from modifying data and recomputing the hash.

What hash algorithms can HMAC use?

HMAC can use any cryptographic hash function. Common choices: HMAC-SHA256 (recommended, most widely used), HMAC-SHA512 (maximum security), HMAC-SHA384, HMAC-SHA1 (deprecated but still in legacy systems), HMAC-MD5 (deprecated, avoid).

Where is HMAC used in real applications?

HMAC is used in: API authentication (AWS, Stripe, webhooks), JWT token signatures (HS256, HS512), OAuth 1.0, secure cookies, message authentication in protocols, webhook verification, API request signing, and data integrity verification.

Yes, HMAC is cryptographically secure when used with a secure hash function (SHA-256 or better) and a strong, random secret key. HMAC's security is proven mathematically - it's secure if the underlying hash function is secure.

What makes a good HMAC secret key?

A good HMAC key should be: at least as long as the hash output (32 bytes for SHA-256, 64 bytes for SHA-512), randomly generated using a cryptographic random number generator, kept secret and never transmitted with the message, and unique per application.

Can HMAC be reversed to find the key?

No, HMAC is based on one-way hash functions and cannot be reversed. You cannot recover the secret key or original message from an HMAC output. Brute-forcing a strong key is computationally infeasible.

What is the difference between HMAC and digital signatures?

HMAC uses symmetric keys - the same secret key for signing and verifying (both parties must share the key). Digital signatures use asymmetric keys - a private key signs, a public key verifies (only the signer needs the private key).

How do I verify an HMAC?

Compute the HMAC of the received message using the same secret key and algorithm, then compare it to the received HMAC. CRITICAL: Use constant-time comparison to prevent timing attacks. Never use simple string equality (==).

What is HMAC-SHA256 and why is it recommended?

HMAC-SHA256 uses SHA-256 as the underlying hash function, producing a 256-bit (64 char) authentication code. It's recommended because SHA-256 is secure, widely supported, fast, and provides sufficient security for virtually all applications.

How do I use HMAC for API authentication?

Typical flow: 1) Construct a canonical string from request data (method, path, timestamp, body), 2) Compute HMAC of this string with your secret key, 3) Include the HMAC in the Authorization header, 4) Server recomputes and compares.

What is the difference between HMAC and encryption?

HMAC provides authentication and integrity - it proves who sent the message and that it wasn't modified. Encryption provides confidentiality - it hides the message content. They serve different purposes and are often used together.

How do I use HMAC in programming?

Most languages have HMAC built-in: JavaScript (crypto.subtle.sign("HMAC")), Python (hmac.new()), PHP (hash_hmac()), Java (Mac.getInstance("HmacSHA256")), Node.js (crypto.createHmac()), Go (crypto/hmac).

Is my data secure when using this HMAC generator?

Yes! All HMAC generation happens 100% in your browser using JavaScript. Your message and secret key never leave your device or get uploaded to any server. This makes it safe for generating HMACs with production API keys.

HMAC Generator

medium

Generate HMAC authentication codes with SHA-256, SHA-512, and other algorithms. Create keyed-hash message authentication codes for API authentication, JWT signing, and secure message verification.

Hash & Cryptohmacmacauthenticationsignature

100% Private - Runs Locally

How to Use

1Enter message and secret key
2Select HMAC algorithm
3View HMAC output
4Use for API authentication

Examples

HMAC-SHA256

Input

Message: Hello, World! | Key: secret

Output

a4331d1b1e0e8c5e8e8c5e8e8c5e8e8c5e8e8c5e8e8c5e8e8c5e8e8c5e8e8c5e

API Signature

Input

Message: GET /api/users | Key: api_key_123

Output

b5442e2c2f1f9d6f9f9d6f9f9d6f9f9d6f9f9d6f9f9d6f9f9d6f9f9d6f9f9d6f

JWT Signature

Input

Message: header.payload | Key: jwt_secret

Output

c6553f3d3g2g0e7g0g0e7g0g0e7g0g0e7g0g0e7g0g0e7g0g0e7g0g0e7g0g0e7g

Frequently Asked Questions

Related Tools

View all

SHA-256 Hash Generator

Generate secure SHA-256 hashes from text or files instantly. Create 256-bit (64 character) cryptographic hashes for security applications, file verification, and blockchain. The industry standard for secure hashing.

JWT Decoder

Decode and inspect JWT tokens without verification. View header, payload, claims, and expiration status. Debug authentication tokens from OAuth, OpenID Connect, and API authorization systems.

Hash Checker/Verifier

Verify file integrity by comparing hashes. Auto-detect MD5, SHA-1, SHA-256, SHA-512 algorithms. Confirm downloads weren't corrupted or tampered with by comparing computed hashes against expected values.