About this tool
What is HMAC?
Hash-based Message Authentication Code: it combines a secret key with a hash function (HMAC-SHA256 being the standard) so the receiver can verify both integrity and authenticity. APIs use it to sign webhooks and requests — the signature proves the sender holds the key.
How to use it
- Enter the message and the shared secret key.
- Pick the hash (SHA-256 default; SHA-512 for higher margins).
- Compare the output with the expected signature using constant-time comparison in code.
Examples
- Verifying a payment webhook: recompute HMAC over the payload with your secret.
- Signing API requests so the server knows they came from you.
- Deriving per-user tokens from one master secret.
Important limitations
- Security lives entirely in the key: leak it and signatures are forgeable.
- Always compare signatures in constant time — naive string comparison leaks timing info.
- HMAC authenticates; it does not encrypt. Secrets in the message stay readable.
Privacy
Computed locally. Keys and messages never leave your browser — test with disposable secrets, never production keys.
Frequently asked questions
HMAC vs plain hash?
A plain hash anyone can recompute; HMAC needs the secret key, which proves origin.
Which hash inside HMAC?
SHA-256 for general use. MD5/SHA-1 inside HMAC are less broken than standalone, but prefer SHA-256/SHA-512.
How long should the key be?
At least the hash output size (32 bytes for SHA-256), random from a CSPRNG.