HMAC Generator
Generate HMAC authentication codes with SHA-256, SHA-384, SHA-512, or SHA-1. All computation happens in your browser.
HMAC Result
Algorithm
—
Output Size
—
Key Length
—
Time
—
Enter a message and secret key, then click Generate HMAC
What is HMAC?
HMAC (Hash-based Message Authentication Code) is defined in RFC 2104. It combines a cryptographic hash function with a secret key to produce an authentication tag that verifies both data integrity and authenticity. Unlike a plain hash, HMAC ensures that only parties possessing the secret key can generate or verify the tag.
Common Use Cases
API Authentication
AWS Signature V4, Stripe webhooks, GitHub webhooks all use HMAC-SHA256 to sign and verify requests.
JWT Signing
HS256, HS384, and HS512 JWT algorithms use HMAC with the corresponding SHA variant.
Webhook Verification
Services like Stripe, GitHub, and Shopify send HMAC signatures with webhooks for payload verification.
TOTP / HOTP
Time-based One-Time Passwords (RFC 6238) use HMAC-SHA1 to generate 2FA codes.
HMAC Algorithm Comparison
| Algorithm | Output | Security | Use Case |
|---|---|---|---|
| HMAC-SHA1 | 160 bits | Legacy | TOTP, OAuth 1.0 |
| HMAC-SHA256 | 256 bits | Recommended | APIs, JWT (HS256), webhooks |
| HMAC-SHA384 | 384 bits | Strong | JWT (HS384), TLS |
| HMAC-SHA512 | 512 bits | Maximum | JWT (HS512), high security |
Code Examples
Node.js
const crypto = require('crypto');
const hmac = crypto.createHmac('sha256', 'secret-key')
.update('message')
.digest('hex');Python
import hmac, hashlib
result = hmac.new(b'secret-key', b'message', hashlib.sha256).hexdigest()PHP
$hmac = hash_hmac('sha256', 'message', 'secret-key');