HMAC Generator

How to Use

1. Select an HMAC algorithm — HMAC-SHA256 is the most widely used.
2. Enter your secret key in the key field (click Show to reveal it).
3. Enter or paste the message to authenticate.
4. The HMAC signature updates automatically. Switch between hex and Base64 output.
5. To verify a webhook signature, click Verify mode, paste the expected signature, and check if it matches.
6. Click Copy to copy the result.

What Is HMAC?

HMAC (Hash-based Message Authentication Code) is defined in RFC 2104. It combines a cryptographic hash function (like SHA-256) with a secret key to produce a signature that verifies both the integrity and authenticity of a message. The key insight: even if an attacker knows the hash algorithm and the message, they cannot forge a valid HMAC without the secret key.

The HMAC construction works by XOR-ing the key with two different padding constants (ipad and opad), then hashing the result in two passes: HMAC(K, m) = H((K' XOR opad) || H((K' XOR ipad) || m)). This double-hashing construction provides security even if the underlying hash function has certain weaknesses.

Common Use Cases

• Webhook verification — Stripe, GitHub, Slack, and most SaaS providers sign webhook payloads with HMAC-SHA256. You verify by computing the HMAC of the request body with your webhook secret and comparing it to the signature header.
• JWT signing — JWTs using HS256, HS384, or HS512 algorithms are signed with HMAC. The signature ensures the token hasn't been tampered with.
• API authentication — AWS Signature V4 uses HMAC-SHA256 to sign API requests, proving the caller possesses the secret access key without transmitting it.
• Message authentication — TLS, IPsec, and SSH use HMAC to verify that messages haven't been modified in transit.

Verifying Webhook Signatures

Most webhook providers include an HMAC signature in a header like X-Hub-Signature-256 (GitHub) or Stripe-Signature. To verify: compute the HMAC of the raw request body using your webhook secret, then compare it to the header value. Use this tool to quickly test whether your secret and payload produce the expected signature.

HMAC in Code

In JavaScript, use the Web Crypto API: crypto.subtle.importKey() then crypto.subtle.sign('HMAC', key, data). In Node.js, use crypto.createHmac('sha256', secret).update(message).digest('hex'). In Python, use hmac.new(key, msg, hashlib.sha256).hexdigest().

HMAC-SHA1 Security

While plain SHA-1 is considered broken for collision resistance, HMAC-SHA1 remains cryptographically secure. The HMAC construction's security depends on the hash function's pseudorandom function (PRF) properties, not its collision resistance. However, most new implementations prefer HMAC-SHA256 to avoid confusion and future-proof against potential attacks.

Related Tools

Generate plain hashes with the Hash Generator. Decode and inspect JWT tokens signed with HMAC. Encode binary data with the Base64 Encoder. Generate secure keys with the Password Generator. Test API requests with the Curl Converter.