HMAC Generator

How to generate an HMAC signature?

Generating an HMAC signature takes just a few steps: Type or paste your message into the input box — this could be an API request body, a webhook payload, or any text you need to authenticate. Enter your secret key — this is the shared secret known only to you and the party verifying the signature. Choose your hash algorithm: SHA-256 for most applications (produces a 64-character hex digest), SHA-384 for higher security margins (96 characters), or SHA-512 for maximum security (128 characters). Click Generate to compute the HMAC. The signature appears instantly in the output box as a hexadecimal string. Copy it and include it in your API request headers (typically X-HMAC-Signature or Authorization header) or webhook payload. The receiving party recomputes the HMAC with the same key and compares — matching signatures prove the message originated from someone who knows the secret.

How HMAC works under the hood

HMAC follows the construction defined in RFC 2104: H((K ⊕ opad) || H((K ⊕ ipad) || message)). The secret key K is first padded to the block size of the hash function (64 bytes for SHA-256, 128 bytes for SHA-512). If the key is longer than the block size, it's hashed first. The padded key is XORed with two constant pads: ipad (0x36 repeated) and opad (0x5c repeated). The inner hash computes H((K ⊕ ipad) || message), then the outer hash computes H((K ⊕ opad) || inner_hash). This double-hashing structure prevents length-extension attacks that affect plain hash functions. Without HMAC, computing H(message || extra_data) from H(message) is trivially possible — with HMAC, the second hash layer uses a different pad derived from the key, making extension impossible without knowing K. This is why GitHub, Stripe, and AWS all require HMAC-based signature verification for webhook delivery.

Real-world HMAC authentication patterns

HMAC authentication appears in several common API patterns. Webhook verification: services like Stripe, GitHub, and Shopify send webhooks with an HMAC-SHA256 signature in the X-Hub-Signature-256 header. Your server recomputes HMAC-SHA256(secret, raw_body) and compares it to the header value — a mismatch means the webhook was tampered with or didn't originate from the expected service. API request signing: AWS Signature V4 uses HMAC-SHA256 to sign HTTP requests, including timestamp, HTTP method, canonical headers, and request payload in the signed string. OAuth 1.0a uses HMAC-SHA1 (deprecated) or HMAC-SHA256 to sign consumer secret + token secret combinations. JWT tokens with HS256, HS384, or HS512 algorithms use HMAC internally — the 'HS' prefix stands for HMAC-SHA. Payment processors like PayPal and Square use HMAC to verify payment notification authenticity. In each case, the secret key must be stored securely (environment variables, secret managers) and never transmitted or logged.