HMAC Generator
Compute HMAC-SHA-256/384/512 message authentication codes with your own secret key, entirely in your browser.
HMAC is a keyed-hash message authentication code. It combines a secret key with a hash function to prove both the integrity and authenticity of a message—only someone holding the same key can produce the same output.
Unlike a plain hash, HMAC is safe against length-extension attacks and is the standard way to sign webhook payloads, API requests, and cookies.
HMAC-SHA-256 is the current default for webhook signatures and API request signing. SHA-384 and SHA-512 are also supported for protocols that demand a larger security margin.
Common uses
- Verifying that a webhook from Stripe, GitHub, or Slack really came from them by recomputing the signature.
- Signing an API request so the server can confirm the caller knows the shared secret without sending it.
Frequently asked questions
- What is the difference between hash and HMAC?
- A hash proves data has not changed; HMAC also proves it came from someone who knows the secret key. Use HMAC whenever authenticity matters.
- Which algorithm should I choose?
- SHA-256 is the current default and is fast and secure. SHA-384/512 offer a larger security margin if your protocol requires it.
- Can I use HMAC for passwords?
- No. HMAC is designed for message authentication, not password storage. Passwords need a deliberately slow, memory-hard function such as Argon2id or bcrypt.
- What if my key is short?
- HMAC pads or hashes short keys to the block size automatically. A 32-character random key is a common and safe choice.
- Is the result deterministic?
- Yes. The same key and message always produce the same HMAC, which is how the receiver can verify the signature without seeing the key.