HMAC Generator

What is HMAC?

HMAC stands for Hash-based Message Authentication Code. It combines a cryptographic hash function (like SHA-256) with a secret key to produce a fixed-length code that proves two things at once: that a message has not been tampered with, and that it came from someone who holds the shared secret key. A plain hash can only prove the former — anyone can recompute it — so HMAC is what you reach for whenever authenticity matters, not just integrity.

This tool computes HMAC locally using the browser's Web Crypto API. Your message and key are never transmitted or stored.

How to Use This Tool

1. Paste the message or payload you want to authenticate.
2. Enter the secret key shared between sender and receiver.
3. Pick the hash algorithm (SHA-256 is the common default) and the output encoding (hex or Base64).
4. Click Generate HMAC and copy the result.

Where HMAC is Used

• Webhook signatures — GitHub, Stripe, Shopify, and others sign each webhook payload with HMAC so your endpoint can verify it really came from them (GitHub uses HMAC-SHA256 in the X-Hub-Signature-256 header).
• API request signing — AWS Signature Version 4 derives a signing key and produces an HMAC-SHA256 over the canonical request.
• JWT tokens — The HS256 / HS384 / HS512 algorithms sign a token with HMAC so the server can verify it without a database lookup.
• One-time passwords — TOTP and HOTP (Google Authenticator) are built on HMAC-SHA1 of a counter or time step.
• Message integrity — Any system that needs to detect tampering by an attacker who could otherwise recompute a plain hash.

HMAC vs. Plain Hash

If you publish SHA256(message), an attacker who modifies the message can simply publish a new hash to match — the hash alone proves nothing about origin. With HMAC-SHA256(key, message), the attacker cannot forge a valid code without the secret key. Always compare HMACs using a constant-time comparison on the server to avoid timing attacks.