HMAC Generator

HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the integrity and authenticity of a message. It combines a secret key with a cryptographic hash function (typically SHA-256 or SHA-512) to produce a digest that can only be reproduced by someone who knows the key.

A plain hash takes only data as input — anyone who knows the algorithm can reproduce it. HMAC takes data and a secret key, so only parties who share the key can generate or verify the MAC. A plain hash proves data was not corrupted (accidental integrity); HMAC proves data was not tampered with by an attacker (authenticated integrity).

Recompute the HMAC using your shared secret and the request body or payload. Compare your computed HMAC to the one in the request header (e.g. X-Hub-Signature-256). Use a constant-time comparison (crypto.timingSafeEqual in Node.js, hmac.compare_digest in Python) to prevent timing attacks. If they match, the payload is authentic.

HMAC-SHA256 is the standard choice and is used by AWS Signature Version 4, GitHub webhooks, Stripe webhooks, and most modern APIs. HMAC-SHA512 provides more resistance to brute-force key attacks when keys are short, but a 32-byte (256-bit) random key is already sufficient with HMAC-SHA256. Both are considered secure for current use.

No. HMAC is designed to be fast and is therefore vulnerable to brute-force key/password attacks when the key space is small (human-chosen passwords). Password storage requires a slow hash function specifically designed for the purpose: bcrypt, Argon2id, or scrypt. These are intentionally slow to make offline brute-force attacks impractical.