What Is HMAC and How Does Message Authentication Work?
HMAC is how APIs and webhooks prove a message is genuine. This guide explains keys, signing and verification in plain terms.
What is the HMAC Generator?
An HMAC combines a secret key with a message to produce a fingerprint that only someone holding the key can reproduce, which is how receivers check that a message is genuine and unaltered. This tool signs with the browser's WebCrypto API using SHA-256 or SHA-1, and the key and message never leave your device. Keep the key secret: anyone with it can forge a valid HMAC.
How to use it
- Enter the secret key.
- Enter the message to sign.
- Choose the algorithm and click Generate HMAC.
Worked example
Signing the sample message hello with the sample key secret using SHA-256 produces a 64-character hexadecimal HMAC.
Do I need the same key to verify an HMAC?
Yes. Verification means recomputing the HMAC with the same key and message and checking that the two values match exactly.
Frequently asked questions
What is the difference between a hash and an HMAC?
A plain hash needs no key, so anyone can compute it; an HMAC needs the secret key, so it also proves the message came from a key holder.
Should I use SHA-256 or SHA-1?
Prefer SHA-256: SHA-1 is weaker and is kept here only for checking older systems that still require it.