HMAC Generator
Compute keyed HMAC signatures (SHA-1, SHA-256, SHA-384, SHA-512).
Overview
The HMAC generator computes a keyed message authentication code over any text using SHA-1, SHA-256, SHA-384, or SHA-512. Paste a message and a secret, pick an algorithm, and get the hex (and base64) digest you can compare against a signed webhook, a JWT signature, or an API request signature.
It is the everyday workhorse for engineers verifying GitHub or Stripe webhook signatures, building signed API requests, or matching an HMAC-SHA-256 online value against a backend implementation. Unlike a plain hash, HMAC binds the digest to a shared secret, so an attacker who cannot guess the key cannot produce a valid signature.
How it works
HMAC, defined in RFC 2104 and standardised in FIPS 198-1, builds a MAC from any cryptographic hash. The construction is HMAC(K, m) = H((K' XOR opad) || H((K' XOR ipad) || m)), where K' is the key padded to the hash's block size (after being hashed down first if it is too long), ipad = 0x36 repeated, and opad = 0x5C repeated. The double-hash sandwich gives strong security guarantees even when the underlying hash has minor weaknesses — HMAC-SHA-1 is still considered safe as a MAC, despite SHA-1's collision break.
Examples
Key: "secret"
Msg: "Hello, world!"
Algo: SHA-256
Output: 1bea1bf... (64 hex chars)
Key: "key"
Msg: "The quick brown fox jumps over the lazy dog"
Algo: SHA-256
Output: f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8
Key: ""
Msg: ""
Algo: SHA-1
Output: fbdb1d1b18aa6c08324b7d64b71fb76370690e1d
FAQ
Hash or HMAC for signing?
Always HMAC when there is a shared secret. A plain hash of secret + message is vulnerable to length-extension on SHA-1 and SHA-2 (not SHA-3 or BLAKE2). HMAC was specifically designed to fix that and is the safe construction.
What length should my key be?
At least as long as the hash output. HMAC-SHA-256 with a 32-byte random key is the common default. Keys longer than the block size are pre-hashed, which is fine but loses some entropy.
Do I compare signatures with ==?
Use a constant-time comparison. A naive == lets a remote attacker measure timing differences and recover the signature one byte at a time. Every server-side framework worth its salt ships a hmac.compareDigest equivalent.
Why are GitHub webhooks signed with HMAC-SHA-256?
Because both parties (GitHub and your server) hold the same secret. Verifying the signature proves the request came from someone with the secret, which is faster and simpler than full TLS client certs for webhook validation.