HMAC Generator
Generate HMAC message authentication codes — SHA256, SHA512, SHA1, MD5
How to Use the HMAC Generator
- Enter the message you want to authenticate.
- Enter a secret key shared between sender and receiver.
- Select the hash algorithm (SHA-256, SHA-512, SHA-1, SHA-3, or MD5).
- Choose Hex or Base64 output format.
- Click Generate HMAC to produce the authentication code.
HMAC (Hash-based Message Authentication Code) provides message integrity and authenticity. It combines a cryptographic hash function with a secret key, making it resistant to length-extension attacks.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a specific construction for creating a message authentication code using a cryptographic hash function (SHA-256, SHA-512, etc.) combined with a secret key. It provides both data integrity (the message wasn't changed) and authenticity (it came from someone who knows the key).
Common Uses
- API request signing — verify that requests come from authorised clients
- Webhook payload verification (GitHub, Stripe, and others use HMAC-SHA256)
- JWT signature generation (HS256 = HMAC with SHA-256)
- Verifying file downloads haven't been tampered with
Frequently Asked Questions
What is the difference between HMAC and a regular hash?
A regular hash (SHA-256) of a message can be computed by anyone. An HMAC requires a secret key, so only parties who know the key can produce or verify the MAC. This prevents attackers from forging valid hashes.
How do I verify a GitHub webhook with HMAC?
GitHub signs webhook payloads with HMAC-SHA256 using your webhook secret as the key. Compute HMAC-SHA256 of the raw request body with your secret, prefix it with "sha256=", and compare it to the X-Hub-Signature-256 header using a constant-time comparison.
Which hash algorithm should I use with HMAC?
HMAC-SHA256 is the most common and recommended choice. It offers a good balance of security and performance. HMAC-SHA512 provides a longer MAC but is rarely needed. Avoid HMAC-MD5 and HMAC-SHA1 for new systems.
Notes from this implementation
The key is the whole point
HMAC is a MAC: hash(key, hash(key, message)) with the padding the RFC specifies. This page takes a key and a message and a hash choice. The same message with an empty key is not “just the hash.” An empty key is still a key, and it will not match a SHA-256 of the message alone.
People paste a JWT secret here to recompute an HS256 signature. The JWT signing input is the Base64URL header, a dot, and the Base64URL payload, not the decoded JSON. If you HMAC the pretty-printed JSON you will not match the third segment of the token. Use the JWT decoder to see the segments, then HMAC the exact signing input.
What a match proves
A matching MAC means someone who knows the key produced that tag, or the key leaked. It does not encrypt the message. The message on this form sits in the clear next to the tag.