How to use the HMAC Generator
1. Enter the message you want to authenticate in the Message field.
2. Enter your shared secret key in the Secret Key field.
3. Select the HMAC algorithm and copy the resulting hex digest.
What is it?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a message authentication code. Unlike plain hashing, HMAC verifies both the integrity of the data (it hasn't been tampered with) and its authenticity (it came from someone who knows the secret key).
HMAC is widely used in API authentication (AWS Signature V4, Stripe webhook verification, JWT HS256 tokens), data integrity checks, and secure message passing. The receiver recomputes the HMAC with the same key and verifies it matches the one sent with the message. All computation happens locally — your secret key is never transmitted.
Example
Hello, World!
757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17
The output is deterministic — the same message + secret always produces the same HMAC. A different secret produces a completely different code.
Benefits
Verify webhook authenticity from Stripe, GitHub, and AWS
HMAC signatures confirm that a webhook came from the expected sender and was not modified in transit — the mechanism behind most webhook security.
Protect API requests from tampering in transit
HMAC-signed requests cannot be modified without invalidating the signature — the server detects any change to the body or headers.
Debug webhook signature verification during integration
Compute the expected HMAC to confirm your signature verification logic produces the correct result before deploying your handler.
Generate test signatures for webhook handler unit tests
Produce known HMAC values for a given payload and secret to create deterministic test assertions for your webhook handling code.
Frequently asked questions
What is HMAC used for in practice?
HMAC is used to verify API webhook payloads (Stripe, GitHub, Slack all use HMAC-SHA256), sign JWT tokens (HS256/HS512 algorithm), authenticate AWS API requests (Signature Version 4), and secure cookie/session tokens.
What is the difference between SHA-256 and HMAC-SHA256?
SHA-256 is a hash function — it takes input and produces a fixed hash, but anyone with the input can reproduce it. HMAC-SHA256 requires a secret key, so only parties who know the key can generate or verify the code. HMAC provides authentication, plain hashing does not.
How long should the secret key be?
HMAC security depends on the key. NIST recommends keys at least as long as the hash output: 32+ bytes for HMAC-SHA256, 64+ bytes for HMAC-SHA512. Shorter keys are technically valid but weaker. Use a cryptographically random key for production use.