HMAC Generator
Generate HMAC hash signatures using SHA-1, SHA-256, SHA-384, or SHA-512 algorithms. Secure message authentication for API development and data integrity verification.
What is HMAC?
HMAC (Hash-based Message Authentication Code) is a mechanism for message authentication using cryptographic hash functions. It verifies both data integrity and authenticity of a message, ensuring the message hasn't been tampered with and comes from a legitimate sender.
How does HMAC work?
HMAC combines a secret key with the message data using a cryptographic hash function (like SHA-256). The process involves hashing the message with the key in a specific way, producing a fixed-size output that serves as both a fingerprint and authentication tag for the message.
What algorithms are supported?
This tool supports HMAC generation with SHA-1, SHA-256, SHA-384, and SHA-512 algorithms. SHA-256 is recommended for most use cases as it provides excellent security and performance balance. SHA-1 is deprecated for security-critical applications.
What is the difference between HMAC and regular hash?
A regular hash (like SHA-256) only verifies data integrity - anyone can compute it. HMAC adds a secret key to the process, providing both integrity and authentication. Only parties with the correct key can generate or verify the HMAC, making it secure for authentication purposes.
Is HMAC secure?
HMAC is considered secure when used with strong hash functions (SHA-256 or above) and sufficiently long secret keys. The security depends on the underlying hash function's resistance to collision and preimage attacks, plus the secrecy and length of the key.
What is HMAC used for?
HMAC is widely used for API authentication (like REST APIs), JWT token generation, message integrity verification, secure communication protocols (TLS, SSH), password storage, and data validation. It's essential for ensuring data hasn't been modified in transit.
How long should my HMAC key be?
For SHA-256, use at least a 256-bit (32-byte) key. For SHA-512, use at least 512-bit (64-byte) keys. Longer keys provide better security. The key should be randomly generated and kept secret. Never use weak or predictable keys.
What is the difference between HMAC and encryption?
HMAC provides message authentication and integrity but doesn't encrypt data - the message remains readable. Encryption makes data unreadable to unauthorized parties. They serve different purposes: HMAC verifies authenticity, encryption provides confidentiality.
Is HMAC the same as a digital signature?
No. HMAC uses symmetric cryptography where both parties share the same secret key. Digital signatures use asymmetric cryptography with public/private key pairs. HMAC is faster and simpler but requires secure key distribution, while digital signatures provide non-repudiation.
How do I verify an HMAC?
To verify an HMAC, the recipient computes the HMAC using the same algorithm, message, and secret key, then compares it with the received HMAC. If they match exactly, the message is authentic and unmodified. Always use constant-time comparison to prevent timing attacks.
What is HMAC-SHA256?
HMAC-SHA256 is HMAC using the SHA-256 hash function. It produces a 256-bit (32-byte) hash value and is widely used in web APIs, JWT tokens, and secure communications. It's currently the most commonly used HMAC variant for general-purpose authentication.
Can HMAC be used for password storage?
While HMAC can be used in password storage systems, it's not recommended to use it alone. Modern password storage should use specialized algorithms like bcrypt, scrypt, or Argon2 that are designed to be slow and resistant to brute-force attacks.
How to Use HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 to authenticate messages and verify API requests. All hashing runs locally in your browser — your secret key is never sent anywhere.
- Enter the message you want to sign into the message field, for example Hello, World!
- Type your secret into the Secret Key field (the placeholder shows an example like my-secret-key).
- Select the hash function in the Algorithm list: SHA-256, SHA-1, SHA-384, or SHA-512.
- Copy the resulting signature and compare it with the value the other side of your API expects.
- Change the key or message and watch the signature change completely — that is how tampering is detected.
Both sides must use the exact same algorithm and key; a single different character produces a completely different signature.
Related Tools
- Hash Generator Generate MD5, SHA-1, SHA-256, SHA-512 hashes from text instantly in your browser
- File Hash Checker Calculate and verify MD5, SHA-1, SHA-256, SHA-512 file hashes locally
- PDF Unlock Remove password protection from PDF files instantly in your browser. Includes smart brute-force password recovery.
- Protect PDF Add password protection to PDF files online for free. Encrypt PDF documents with AES-256 encryption to prevent unauthorized access. 100% browser-based, no upload required.
- Basic Auth Header Generator Generate HTTP Basic Authentication headers online — encode username:password to Base64 Authorization header instantly
- Text Encryption Secure text encryption and decryption with AES-GCM/AES-CBC. Password-based, browser-only processing, no data leaves your device.
- AES Encryption / Decryption AES encrypt/decrypt with CBC, CFB, CTR, OFB, ECB modes, Pkcs7/ZeroPadding/NoPadding, 128/192/256-bit keys, Base64 output, auto-detect key/IV format
- RSA Key Generator Generate RSA key pairs with 2048, 3072, 4096 bit sizes. PEM format output with fingerprint. Runs entirely in your browser.