HMAC combines a secret key with a hash function to produce a message authentication code. Used in API signatures (AWS, Stripe), webhook verification, and JWT tokens. Generate HMAC-SHA256, HMAC-SHA512, or HMAC-MD5 instantly.
API authentication (AWS Signature v4, Stripe webhooks, GitHub webhooks), JWT signing (HS256), session token validation, and any system that needs to verify both data integrity and authenticity.
Try It Now — Free, No Sign-up
Open the tool and get started instantly. No sign-up, no installation needed.
Open Hash Generator Now100% browser-based • No upload to server • No sign-up required
How to HMAC Generator — Hash-based Message Authentication Code
- Open the Hash Generator tool
- Enter your message/data in the input field
- Enter your secret key
- Select HMAC algorithm (HMAC-SHA256 recommended)
- Click "Generate HMAC"
- Compare the output with the expected signature for verification
Pro Tips
- HMAC-SHA256 is the most common — used by AWS, Stripe, GitHub, Slack
- The key should be at least as long as the hash output (32 bytes for SHA-256)
- HMAC is secure even with MD5 — the key-mixing prevents known MD5 attacks
- For webhook verification: compute HMAC of the body and compare with the header signature
Frequently Asked Questions
What is HMAC used for?
HMAC verifies both data integrity (not modified) and authenticity (from the right sender). Used in API signatures, webhook verification, JWT tokens (HS256), and secure cookie signing.
How is HMAC different from a regular hash?
A regular hash only proves integrity. HMAC proves integrity AND authenticity because only someone with the secret key can produce the correct HMAC. An attacker cannot forge it without the key.
How to verify a webhook signature?
Compute HMAC-SHA256 of the webhook body using your secret key. Compare (timing-safe) with the signature in the request header. If they match, the webhook is authentic.
Is HMAC-MD5 secure?
Yes, surprisingly. HMAC construction is secure even with weakened hash functions. HMAC-MD5 has no known practical attacks. However, prefer HMAC-SHA256 for new implementations.
Related Tools & Guides
Ready to Use Hash Generator?
Free, instant, and 100% private. No sign-up needed.
Open Hash Generator