HMAC Generator
Compute a Hash-based Message Authentication Code (HMAC) using a secret key and MD5, SHA-1, SHA-256, SHA-384 or SHA-512.
Loading tool...
HMAC Explained
What is an HMAC?
An HMAC (Hash-based Message Authentication Code, RFC 2104) is a short tag computed from a message and a secret key using a cryptographic hash function. Anyone who knows the key can recompute the tag; anyone who does not cannot.
What does it protect?
- Integrity: any change to the message changes the tag.
- Authenticity: only holders of the secret key can produce a valid tag.
- It does not provide confidentiality or non-repudiation.
Choosing a key
- Use a random key, at least as long as the hash output (32 bytes for SHA-256, 64 for SHA-512).
- Human-readable passwords make poor keys. Use PBKDF2, scrypt or Argon2 first.
- Compare tags with a constant-time comparison to avoid timing attacks.
Typical uses
| Use | How HMAC is applied |
|---|---|
| API request signing | AWS Signature v4, Azure Shared Key |
| JSON Web Tokens | HS256/HS384/HS512 signatures |
| Webhooks | GitHub, Stripe, Slack sign webhook bodies |
| One-time passwords | HOTP/TOTP (Google Authenticator) |
| Cookies | Frameworks sign cookies to prevent tampering |