Hashes/Crypto
HMAC Generator
Compute HMAC (Hash-based Message Authentication Code) of text or a file with a secret key — eight algorithms at once: MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, RIPEMD-160.
HMAC (Hash-based Message Authentication Code) is a hash computed together with a secret key, proving a message hasn't changed and was sent by someone who knows that key. Unlike a plain hash, an HMAC can't be forged without knowing the secret.
How to use it
- Enter text or a file and a secret key — the HMAC is computed instantly with eight algorithms at once (MD5, SHA-1, SHA-2, SHA3, RIPEMD-160).
- Copy the variant you need to verify a signature or compare against an expected value.
- The same input and key always produce the same HMAC — handy for checking against a signature received from another system.
Common uses
- Verifying a webhook signature from a payment service or API (most sign the payload with HMAC-SHA256).
- Generating a request signature for an API that requires HMAC authentication.
- Debugging a mismatched signature — checking the key, input encoding, and algorithm one at a time.
Things to keep in mind
HMAC protects against tampering and confirms the sender's authenticity, but it doesn't encrypt the message itself — the content stays readable.
A mismatched HMAC is most often caused by different data encoding (e.g. JSON field order) or a stray whitespace or line break, not by a bug in the algorithm itself.
Article about this tool: HMAC: how a keyed hash differs from a regular hash
Frequently asked questions
What's the difference between HMAC and a plain hash?
A plain hash only proves data wasn't altered; HMAC additionally uses a secret key, so it proves both integrity and that the sender knew the shared secret — someone without the key can't produce a valid HMAC even if they know the algorithm.
Which hash algorithm should I pick for HMAC?
HMAC-SHA256 is a solid modern default. Older choices like HMAC-MD5 or HMAC-SHA1 are still not broken as HMACs specifically, but SHA-256 or stronger is recommended for new systems.
Is my secret key sent anywhere?
No. The HMAC is computed entirely in your browser via the Web Crypto API — the key and message never leave your device.
Why can't I compare an HMAC using a plain equality operator?
A plain string comparison stops at the first mismatch, and its execution time leaks to an attacker how many leading characters they guessed correctly (a timing attack). You need a constant-time comparison function, such as hash_equals in PHP.
Can I reuse the same key for several different purposes?
It's not recommended. If the same secret key is used both to sign webhooks and for another purpose, compromising one system automatically compromises the other — generate a separate key for each distinct purpose.