HMAC Generator
Generate HMAC hash signatures using SHA-1, SHA-256, SHA-384, or SHA-512 algorithms. Secure message authentication for API development and data integrity verification.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a mechanism for message authentication using cryptographic hash functions. It verifies both data integrity and authenticity of a message, ensuring the message hasn't been tampered with and comes from a legitimate sender.
How does HMAC work?
HMAC combines a secret key with the message data using a cryptographic hash function (like SHA-256). The process involves hashing the message with the key in a specific way, producing a fixed-size output that serves as both a fingerprint and authentication tag for the message.
What algorithms are supported?
This tool supports HMAC generation with SHA-1, SHA-256, SHA-384, and SHA-512 algorithms. SHA-256 is recommended for most use cases as it provides excellent security and performance balance. SHA-1 is deprecated for security-critical applications.
What is the difference between HMAC and regular hash?
A regular hash (like SHA-256) only verifies data integrity - anyone can compute it. HMAC adds a secret key to the process, providing both integrity and authentication. Only parties with the correct key can generate or verify the HMAC, making it secure for authentication purposes.
Is HMAC secure?
HMAC is considered secure when used with strong hash functions (SHA-256 or above) and sufficiently long secret keys. The security depends on the underlying hash function's resistance to collision and preimage attacks, plus the secrecy and length of the key.
What is HMAC used for?
HMAC is widely used for API authentication (like REST APIs), JWT token generation, message integrity verification, secure communication protocols (TLS, SSH), password storage, and data validation. It's essential for ensuring data hasn't been modified in transit.
How long should my HMAC key be?
For SHA-256, use at least a 256-bit (32-byte) key. For SHA-512, use at least 512-bit (64-byte) keys. Longer keys provide better security. The key should be randomly generated and kept secret. Never use weak or predictable keys.
What is the difference between HMAC and encryption?
HMAC provides message authentication and integrity but doesn't encrypt data - the message remains readable. Encryption makes data unreadable to unauthorized parties. They serve different purposes: HMAC verifies authenticity, encryption provides confidentiality.
Is HMAC the same as a digital signature?
No. HMAC uses symmetric cryptography where both parties share the same secret key. Digital signatures use asymmetric cryptography with public/private key pairs. HMAC is faster and simpler but requires secure key distribution, while digital signatures provide non-repudiation.
How do I verify an HMAC?
To verify an HMAC, the recipient computes the HMAC using the same algorithm, message, and secret key, then compares it with the received HMAC. If they match exactly, the message is authentic and unmodified. Always use constant-time comparison to prevent timing attacks.
What is HMAC-SHA256?
HMAC-SHA256 is HMAC using the SHA-256 hash function. It produces a 256-bit (32-byte) hash value and is widely used in web APIs, JWT tokens, and secure communications. It's currently the most commonly used HMAC variant for general-purpose authentication.
Can HMAC be used for password storage?
While HMAC can be used in password storage systems, it's not recommended to use it alone. Modern password storage should use specialized algorithms like bcrypt, scrypt, or Argon2 that are designed to be slow and resistant to brute-force attacks.