HMAC Generator rfc 2104
Produce HMAC-SHA256, SHA-512, SHA-1, or MD5 signatures from a secret key and a message, for webhook and API verification.
What this tool does
HMAC combines a hash function with a secret key to produce a message authentication code. The name stands for Hash-based Message Authentication Code and the construction is standardised in RFC 2104.
A plain hash cannot authenticate a message. Anyone can compute one, so an attacker who alters the message simply recomputes the hash and attaches it. HMAC solves this by folding in a secret key known only to sender and receiver. Without the key a correct HMAC cannot be produced, so a matching value means the message was not altered and came from someone holding the key.
Internally the key is padded to the block size, combined with two different pad values, and hashed twice. That nested structure is what makes HMAC resistant to length extension attacks. This tool computes the value with crypto-js in your browser and transmits neither the key nor the message.
When to use it
Use it to verify the signature header on a webhook from a payment provider or GitHub, to compare against the expected value while implementing request signing, to check that signing code written in another language produces the right result, or to reproduce a signature example from documentation.
Input and output examples
message hello, key my-secret-key, HMAC-SHA256
3ac7fc22f5cbd1aaaea11fac013d3e6f5d894fe2fc51ab98b6d3b1593a45255a
Changing one character of the key changes the entire result.
same input, base64 output
Osf8IvXL0aquoR+sAT0+b12JT+L8UauYttOxWTpFJVo=
The same value expressed in base64 instead of hex; services differ in which they expect.
Notes and limitations
Avoid pasting real production secrets into any tool. Computation happens locally, but a leaked key lets anyone forge valid signatures. When verifying signatures in your own code, do not compare strings directly: use a constant-time comparison such as hash_equals in PHP or crypto.timingSafeEqual in Node.js, because timing differences can leak the expected value. Prefer SHA-256 or stronger, and treat HMAC-MD5 as legacy compatibility only.
Frequently asked questions
How is HMAC different from a hash?
A hash needs no key so anyone can compute it, whereas HMAC requires the secret. Only HMAC can therefore authenticate who produced the message.
My webhook signature never matches.
Check exactly what is being signed. Services differ: some sign the raw request body, some prefix a timestamp. Parsing and re-serialising the body changes it by a single space and breaks the signature.
Which algorithm should I pick?
HMAC-SHA256 is the standard choice for new systems. Use the SHA-1 and MD5 variants only for compatibility with something that already exists.