Generate HMAC (Hash-based Message Authentication Code) signatures instantly. Supports SHA-256, SHA-512, and SHA-1 algorithms. No data is stored or transmitted — everything runs in your browser.
HMAC (Hash-based Message Authentication Code) is a mechanism for computing a message authentication code using a cryptographic hash function combined with a secret key. Defined in RFC 2104, HMAC provides both data integrity and message authentication — it proves that a message hasn't been tampered with and that it was sent by someone who knows the secret key.
The formula is: HMAC(K, M) = H((K' ⊕ opad) || H((K' ⊕ ipad) || M)) — where K is the key, M is the message, H is the hash function, and ipad/opad are inner/outer padding constants. This double-hashing construction makes HMAC resistant to length-extension attacks that affect plain hash functions.
API authentication. Most REST APIs use HMAC signatures to authenticate requests. Services like AWS, Stripe, and Twilio require clients to sign API requests with HMAC-SHA256 using a secret key. The server recomputes the HMAC to verify the request is authentic and unmodified.
Webhook verification. When services send webhook notifications (GitHub, Shopify, Slack), they include an HMAC signature in the headers. Your server recomputes the HMAC using your shared secret to verify the webhook is genuine and hasn't been forged.
JWT (JSON Web Tokens). JWTs signed with the HS256 algorithm use HMAC-SHA256 to create the signature segment. The server verifies the token's integrity and authenticity by recomputing the HMAC with its secret key.
Secure cookie signing. Web frameworks like Laravel, Django, and Express sign session cookies with HMAC to prevent tampering. If a user modifies the cookie value, the HMAC verification fails and the session is rejected.
HMAC-SHA256 is the most widely used and recommended choice for new implementations. It provides 256-bit security, is supported everywhere, and is required by most modern API standards.
HMAC-SHA512 is preferred on 64-bit systems where it is actually faster than SHA-256, and provides a larger security margin for high-assurance applications.
HMAC-SHA1 — while SHA-1 alone has known collision vulnerabilities, HMAC-SHA1 remains secure due to HMAC's construction. However, it's being phased out in favour of SHA-256 for compliance reasons.
Yes. This tool uses the browser's native Web Crypto API (crypto.subtle.sign) — the same cryptographic engine used for HTTPS. No keys, messages, or HMACs are transmitted to any server. Everything runs entirely in your browser.