HMAC Generator

A regular hash (SHA-256, MD5) is a one-way transformation of data — anyone with the data can reproduce the hash. HMAC (Hash-based Message Authentication Code) adds a secret key to the process. Only someone with both the message and the key can produce the correct HMAC, so it proves both integrity (message not tampered) and authenticity (sender has the key).

HMAC-SHA256 is the standard for: JWT HS256 signatures (the third segment), webhook verification (GitHub, Stripe, Slack all sign payloads with HMAC-SHA256), API request signing (AWS Signature v4, Shopify webhooks), and session token validation. It's the de facto standard for proving message authenticity in web APIs.

Use HMAC-SHA256 for most cases — it's the industry standard with 256 bits of security and near-universal library support. Use HMAC-SHA512 for extra security or when dealing with very sensitive data. Avoid HMAC-SHA1 for new systems — it's considered weak and should only be used for compatibility with legacy services.

Both represent the same HMAC bytes in different encodings. Hex uses 0-9 and a-f characters — always 64 chars for HMAC-SHA256. Base64 uses A-Z, a-z, 0-9, +, / characters — 44 chars for HMAC-SHA256. Use hex for debugging and logging. Use base64 when transmitting in HTTP headers or URLs.

GitHub sends X-Hub-Signature-256: sha256=<HMAC> in the webhook header. To verify: compute HMAC-SHA256 of the raw request body using your webhook secret as the key, encode as hex, and compare the result to the value after sha256= in the header. Use a constant-time comparison to prevent timing attacks.

This tool uses the Web Crypto API (crypto.subtle.sign) which runs entirely in your browser — the message and key never leave your machine. However, do not use real production secrets in any online tool as a general security practice. Use this tool to understand HMAC or verify implementations with known test vectors.