What is an HMAC Generator?
An HMAC generator computes a Hash-based Message Authentication Code by combining a message with a secret key through a cryptographic hash function. Anyone with the same key can recompute the same HMAC to verify the message hasn't been tampered with.
How to Use This HMAC Generator
- Enter the message you want to authenticate.
- Enter the shared secret key.
- Choose the hash algorithm — SHA-256, SHA-512, or SHA-1.
- Pick hex or base64 output format.
- Click Generate HMAC and copy the result.
When Do You Need HMAC?
HMAC is used to verify webhook signatures from services like Stripe or GitHub, sign API requests, authenticate HS256 JWTs, and protect message integrity in custom protocols where both parties share a secret key.
Frequently Asked Questions
What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to produce a signature that verifies both the integrity and authenticity of a message — only someone with the secret key can produce a valid HMAC.
HMAC vs digital signature?
HMAC uses a shared secret key, so both sides of a communication need the same key. Digital signatures use asymmetric cryptography — a private key signs and a public key verifies — which allows verification without sharing a secret.
HMAC use cases?
HMAC is commonly used to verify webhook payloads, sign API requests, authenticate JWTs (HS256), and protect message integrity in protocols like TLS.
HMAC-SHA256 vs HMAC-SHA512?
Both are secure choices. HMAC-SHA256 produces a shorter 256-bit signature and is more common in APIs and webhooks, while HMAC-SHA512 produces a longer 512-bit signature, offering a larger security margin at the cost of a bigger output.