What is HMAC?
HMAC (Hash-based Message Authentication Code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key. It is used to simultaneously verify both the data integrity and the authenticity of a message. By mixing a shared secret key with the input payload message, it produces a unique signature that cannot be reproduced without access to the identical secret key.
An HMAC Generator is a utility that lets developers simulate and test HMAC signature calculations locally. It allows inputting a custom text message, specifying a secret key, and selecting a hash algorithm to immediately calculate the resulting signature.
Key Features and Settings
This HMAC Generator offers the following configurations:
- Secret Key (Input Field): The shared secret key (e.g.,
supersecretkey) used to sign the message. Changing this key completely alters the resulting hash, demonstrating the cryptographic sensitivity of the secret. - Hash Algorithm (Dropdown Select): Choose the cryptographic hash function to compute the authentication code:
- SHA-256: A secure, modern hashing algorithm from the SHA-2 family producing a highly collision-resistant signature.
- SHA-1: An older cryptographic hash function producing a 160-bit hash. Mainly used for legacy systems compatibility.
- MD5: A legacy message-digest algorithm producing a 128-bit hash. Note that MD5 is cryptographically broken and should only be used for testing or checking backwards compatibility.
- Text Message (Textarea): The raw text string payload (e.g.,
Hello, World!) that you want to sign. - Calculated HMAC Signature (Output Preview): A read-only hexadecimal signature box showing the resulting computed hash.
Real-World Use Cases
- Webhook Verification: Webhook providers (such as Stripe, GitHub, or Shopify) sign HTTP request payloads using HMAC. The receiver recalculates the HMAC using their shared secret to verify that the request came from the trusted provider and was not tampered with in transit.
- API Token Authentication: Generating unique request signatures for REST APIs (like AWS Signature Version 4) where clients submit an HMAC of the request parameters to authenticate without sending their actual API password over the wire.
- Data Integrity Auditing: Confirming that sensitive database files, configuration settings, or messages have not been altered by third parties.
Step-by-Step Guide to Using the HMAC Generator
- Enter the Secret Key: Input your secret key string in the Secret Key field.
- Select the Hash Algorithm: Choose your algorithm (SHA-256, SHA-1, or MD5) from the dropdown menu.
- Input the Message: Type or paste the payload text inside the Text Message box.
- Inspect the Signature: The computed hash will immediately appear under the Calculated HMAC Signature section.
- Copy the HMAC: Click the Copy button to copy the signature string to your clipboard for application validation.