DevToolkit Pro

What Is HMAC

HMAC (Hash-based Message Authentication Code) is an algorithm that uses a cryptographic hash function and a secret key to verify both the integrity and authenticity of a message.

In simple terms, HMAC is a "keyed hash" — only someone with the same key can generate or verify an HMAC value. Try generating one yourself with our HMAC generator: paste a message and secret key, and the signature appears instantly.

HMAC vs Regular Hashing

| Feature | Regular Hash (e.g., SHA-256) | HMAC | |---------|------------------------------|------| | Input | Message only | Message + Key | | Verifiable without key | ✅ | ❌ | | Tamper-resistant | ❌ (anyone can compute) | ✅ (requires key) | | Typical use | File integrity, password storage | API signing, message auth |

How HMAC Works

The HMAC computation formula:

HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m))

Where:

• K = Key
• m = Message
• H = Hash function (e.g., SHA-256)
• K' = Processed key (hashed if too long, padded if too short)
• opad = Outer padding (0x5c repeated)
• ipad = Inner padding (0x36 repeated)

How to Use an Online HMAC Generator

Using DevToolkit Pro's HMAC Generator:

1. Enter your secret key
2. Enter the message to sign
3. Choose the hash algorithm (SHA-256 / SHA-512 / SHA-1 / MD5)
4. Click Generate
5. Copy the resulting HMAC value

Common HMAC Use Cases

1. API Request Signing

Many APIs (AWS, Stripe, WeChat Pay) require HMAC-signed requests:

Authorization: HMAC-SHA256 signature=abc123...

The server computes HMAC with the same key over request parameters and compares it to the client-submitted signature to verify the request hasn't been tampered with.

2. Webhook Verification

GitHub, Stripe, and other platforms verify webhooks using HMAC-SHA256:

const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

3. JWT Signing

JWT's HS256 algorithm is essentially HMAC-SHA256:

header.payload.signature
where signature = HMAC-SHA256(base64(header) + "." + base64(payload), secret)

4. Message Integrity Verification

When transmitting messages over untrusted networks, appending an HMAC ensures the message hasn't been altered in transit.

HMAC Key Security Best Practices

1. Key length: At least 256 bits (32 bytes); use cryptographically secure random generation
2. Key storage: Never hardcode in source code; use environment variables or key management services
3. Key rotation: Rotate keys periodically and reject requests signed with expired keys
4. Timestamp for replay prevention: Include timestamps in signed messages and reject expired ones

FAQ

What's the Difference Between HMAC and Digital Signatures?

HMAC uses symmetric keys (same key for generation and verification); digital signatures use asymmetric keys (private key signs, public key verifies). HMAC is faster but can't prove signature origin to third parties. Choose based on whether non-repudiation is needed.

Which Hash Algorithm Should I Use?

HMAC-SHA256 is the recommended standard. SHA-1 and MD5 are considered insecure and shouldn't be used in new projects.

Can HMAC Prevent Replay Attacks?

Not alone. HMAC only verifies message integrity, not freshness. Combine it with timestamps (timestamp parameter) or nonces to prevent replay attacks.

This article is brought to you by DevToolkit Pro. More developer tools at the homepage.