HMAC Generator
Generate HMAC message authentication codes
¿Qué es HMAC?
HMAC (Hash-based Message Authentication Code) es un tipo de código de autenticación de mensajes que usa una función hash criptográfica junto con una clave secreta. Se utiliza para verificar la integridad y autenticidad de los datos en APIs, webhooks y comunicaciones seguras.
Online HMAC Generator - SHA256 and SHA512 with a Secret Key
What is HMAC and what is it used for in software development?
HMAC (Hash-based Message Authentication Code) is a message authentication code that combines a cryptographic hash function with a secret key. Unlike a plain hash, an HMAC proves both that the message was not altered AND that it came from someone who holds the secret key. It is widely used to verify webhooks from services such as Stripe, GitHub and Slack, authenticate API requests, sign JWT tokens, verify the integrity of downloaded files, and protect communication between microservices.
How do the available HMAC algorithms differ?
HMAC can be built on different underlying hash functions, each with its own profile. HMAC-SHA1 (160 bits) is legacy but still in use across many existing APIs. HMAC-SHA256 (256 bits) is the current recommended standard, offering excellent security with good performance. HMAC-SHA384 and HMAC-SHA512 (384 and 512 bits) provide extra margin for special cases. The overall strength of an HMAC depends as much on the entropy of the secret key as on the algorithm you pick.
How do you verify webhooks using HMAC in your application?
Webhook providers such as Stripe and GitHub send an HMAC signature in a header on every request. To verify it: first, extract the signature from the header, for example X-Hub-Signature-256. Second, compute the HMAC of the raw request body using your secret key. Third, compare your computed HMAC against the received one using a constant-time comparison to prevent timing attacks. Fourth, reject the request when they do not match. This tool helps you debug and confirm that your HMAC calculations are correct.
If you work with this tool, you will probably also find these useful Hash Generator, JWT Decoder, AES Encryption, RSA Key Generator.
Frequently asked questions
What is the difference between HMAC and a plain hash?
A plain hash, such as SHA-256 of a message, can be computed by anyone who knows the message. An attacker could modify the message, recompute the hash and send both. HMAC folds in a secret key that only the authorised parties hold: without that key it is impossible to produce a valid HMAC even when you know the message. That gives you authentication, proving who sent the message, on top of integrity, proving it was not altered.
How long should my HMAC secret key be?
Your secret key should be at least as long as the hash output: 32 bytes (256 bits) for HMAC-SHA256 and 64 bytes for SHA-512. Shorter keys reduce security while longer ones add no benefit. Generate keys with a cryptographically secure generator such as crypto.randomBytes in Node.js rather than using human-chosen passwords. Store them safely in environment variables or a secrets manager, never in source code.
Why do the hexadecimal and Base64 outputs look different?
They are simply two representations of the same bytes. Hexadecimal uses 0-9 and a-f, two characters per byte, which produces a longer string that is easy to inspect visually. Base64 uses A-Z, a-z, 0-9, + and /, roughly 1.33 characters per byte, which is more compact for transmission. APIs usually specify which format they expect, so this tool gives you both for compatibility and debugging.
Are HMAC and a digital signature the same thing?
Not quite. HMAC uses symmetric cryptography, so both parties need the same secret key. Digital signatures such as RSA or ECDSA use asymmetric cryptography with a public and private key pair. HMAC is computationally cheaper and perfect for systems that already share a secret. Digital signatures are preferred when you need public verification without revealing any secret, as with SSL certificates or signed software.