Built and fact-checked by the DocNectar team — see our editorial standards
Key Features
Instant Calculation
Get accurate results in real time with our optimized algorithm.
Mobile Friendly
Fully responsive design. Works on all devices & screen sizes.
Privacy Focused
Your data stays on your device. We don't store any inputs.
100% Free
No hidden costs. This tool is completely free forever.
HMAC (Hash-based Message Authentication Code) proves that a message came from someone who knows a shared secret key, and that it wasn't altered in transit — it's widely used to sign API requests and webhook payloads.
This tool generates an HMAC digest for a message and secret key you provide, using your choice of hash algorithm.
How it works
Enter your message and a secret key, and choose a hash algorithm (MD5, SHA-1, SHA-256, SHA-384, or SHA-512). HMAC combines the key with the message using two passes of that hash function, in a specific construction that prevents length-extension attacks a plain hash-of-key-plus-message would be vulnerable to. The result is a fixed-length hexadecimal digest.
- Enter message.
- Enter secret Key.
- Enter algorithm.
- Click Calculate to see your results.
Examples
HMAC-SHA256 of a short message
Changing even a single character in either the message or the secret key produces a completely different HMAC digest — this is what makes it useful for detecting tampering.
Who should use it
- Verifying webhook or API request signatures.
- Learning how keyed hashing differs from plain hashing.
Industry applications
- API authentication and webhook verification
- Message integrity checking in networking protocols
Advantages
- Prevents length-extension attacks that a plain hash of key+message would be vulnerable to.
- Widely supported standard, easy to verify independently in almost any programming language.
Limitations
- Only proves the message came from someone with the shared key — unlike RSA signatures, it doesn't provide non-repudiation (proof of exactly who sent it, if multiple parties share the key).
Common mistakes to avoid
- Comparing HMAC digests as plain strings with a mismatched case (uppercase vs. lowercase hex) — the underlying bytes are what actually need to match.
- Hashing the message and key together manually instead of using a real HMAC implementation — that skips the construction that makes HMAC secure against length-extension attacks.
Best practices
- Use a long, random secret key rather than a short or guessable one — HMAC's security depends on the key being kept secret and being hard to guess.
- Prefer SHA-256 or stronger for new systems; keep MD5/SHA-1 only for compatibility with existing systems that already require them.
Tips
- If you're verifying an incoming webhook signature, double check which algorithm and key format (raw bytes vs. hex vs. base64) the sender expects — mismatches here are the most common cause of a signature not matching.