Hmac generator

Computes a hash-based message authentication code (HMAC) using a secret key and your favorite hashing function.

Enable JavaScript to use the interactive tool. The guide below explains how it works.

HMAC Generator: Secure Message Authentication Code Utility

1. What the Tool Does

The HMAC (Hash-based Message Authentication Code) Generator is a specialized security tool used to verify both the data integrity and the authenticity of a message. Unlike a standard hash, which only requires the input data, an HMAC involves a cryptographic hash function in combination with a secret cryptographic key.

This tool allows users to input a piece of "Plain text" and a "Secret key," select a hashing algorithm (such as SHA-256 or MD5), and choose an output encoding (Hex, Base64, etc.). The resulting HMAC is a unique fingerprint that can only be generated by someone who possesses both the original message and the secret key. If even a single bit of the message or the key changes, the output becomes entirely different.

2. Why Someone Uses It

HMACs are essential in scenarios where you need to prove that a message hasn't been tampered with and that it definitely came from a trusted source who knows the secret key.

Key Reasons for Use:

• API Authentication: Many modern APIs (like AWS, GitHub, or Stripe) use HMACs to sign requests. The client signs the request body with a secret API key, and the server verifies it by performing the same calculation.
• Webhooks: When a service (like Shopify or GitHub) sends a notification to your server, they often include an X-Hub-Signature header containing an HMAC. Your server uses this to verify that the notification is legitimate and not a spoofed request from an attacker.
• Session Tokens: Some systems use HMACs to sign cookies or JWTs (JSON Web Tokens) to prevent users from modifying their own session data (e.g., changing their user_id or role).
• Secure Communication: Verifying that a message received over an insecure channel has not been altered by a "man-in-the-middle."
• Debugging Security Logic: Helping developers manually generate the same signature their code should be producing, making it easier to find bugs in their implementation.

3. Step-by-Step Instructions

Generating an HMAC

1. Input Plain Text: In the box labeled "Plain text to compute the hash", enter the data you want to sign. This could be a JSON string, a URL, or a simple sentence.
2. Enter Secret Key: In the "Secret key" field, type the shared secret that will be used for the signature. Note: In a real application, this key should be kept extremely secure.
3. Select Algorithm: Use the "Hashing function" dropdown to choose an algorithm. SHA-256 is the industry standard for most modern applications.
4. Choose Encoding: Select the "Output encoding" (Hex is the most common for web signatures).
5. View Result: The tool automatically calculates the HMAC as you type. It appears in the "HMAC of your text" area.

Copying the HMAC

1. Once you are satisfied with the settings, click the "Copy HMAC" button at the bottom of the card.

4. Examples

Scenario A: Verifying a GitHub Webhook

GitHub sends a header sha256=.... To verify it:

1. Copy the raw JSON body of the webhook into the Plain text field.
2. Enter your "Webhook Secret" into the Secret key field.
3. Select SHA256 and Hex encoding.
4. Compare the result with the header GitHub sent.

Scenario B: Signing a JWT (Header + Payload)

1. Paste the base64-encoded header and payload (e.g., eyJhbGci... .eyJzdWIi...) into the Plain text field.
2. Enter your application's JWT_SECRET.
3. Select SHA256 and Base64url encoding.
4. The result should match the "signature" part of your JWT.

Scenario C: Simple Integrity Check

Text: Hello World Key: my-secret-password Algo: MD5 Result (Hex): 7e8b6933580554907a9776d653775b31

5. FAQs

Q: Is an HMAC the same as a Digital Signature? A: No. A digital signature typically uses asymmetric cryptography (Private/Public keys), whereas an HMAC uses symmetric cryptography (a shared Secret key). HMACs are faster but require both parties to know the same secret.

Q: Can I use this tool to "recover" a secret key? A: No. HMACs are designed to be "collision-resistant" and "one-way." You cannot reverse an HMAC to find the key or the message.

Q: Why does the HMAC change so drastically with one small change? A: This is known as the "Avalanche Effect." It ensures that any attempt to tamper with the data is immediately obvious.

Q: Is SHA-1 safe for HMACs? A: While SHA-1 is "broken" for standard hashing (collisions), it is currently still considered somewhat safe for HMACs due to the way the key is mixed in. However, SHA-256 or higher is strongly recommended for all new projects.

6. Common Mistakes

1. Leaking the Secret Key: Never share the secret key you use in this tool. If you are sharing your screen or recording a tutorial, use a dummy key.
2. Incorrect Encoding: Many developers fail to match the encoding. Some systems expect the secret key itself to be Base64-decoded before hashing, or they expect the output to be Base64 instead of Hex.
3. Hidden Whitespace: Ensure there are no accidental spaces or newlines at the end of your plain text or secret key, as these will completely change the resulting HMAC.
4. Wrong Algorithm: Standardizing on SHA-256 is common, but some legacy systems still use MD5 or SHA-1. Always double-check the specification you are working against.
5. Case Sensitivity: Hexadecimal output is usually case-insensitive, but some systems might strictly require lowercase or uppercase. Most tools (including this one) default to lowercase.

7. Use Cases

Backend Developers

Building secure APIs often requires signing requests to prevent unauthorized access. Developers use this tool to create "Gold Standard" hashes to test their code against.

Security Auditors

When testing an application's security, auditors use HMAC generators to see if they can manipulate a message and still produce a valid signature (usually to prove that they cannot if the system is secure).

System Integrators

When connecting two different platforms (like a CRM and a Payment Gateway), HMACs are often used as the "handshake" to ensure data hasn't been modified in transit.

Mobile App Developers

Securing communication between a mobile app and its backend frequently involves signing API calls with a key embedded in the app's binary (obfuscated).

8. Related Tools

• Hash Text: For standard hashing without a secret key (integrity only, not authenticity).
• JWT Parser: For breaking down the components of a JSON Web Token, which often uses HMAC for its signature.
• RSA Key Generator: For asymmetric cryptography, which is used for Digital Signatures.
• Base64 Encoder/Decoder: Often needed to prepare the input or process the output of an HMAC.
• Token Generator: For creating the high-entropy secret keys required for secure HMAC operations.