HMAC Generator
Keyed message authentication — the correct way to prove a message came from someone holding the key.
What HMAC adds that a plain hash does not
HMAC (RFC 2104) mixes a secret key into two hash passes: HMAC(K, m) = H((K ⊕ opad) ‖ H((K ⊕ ipad) ‖ m)). The nesting is not decoration. The naive construction H(key ‖ message) is vulnerable to length extension: given H(key ‖ message) an attacker who knows the key length can compute H(key ‖ message ‖ padding ‖ extra) without ever learning the key. HMAC's outer hash closes that door.
Reference values you can check against
With key key and message The quick brown fox jumps over the lazy dog, RFC 2202 lists MD5 as 80070713463e7749b90c2dc24911e275, and the widely cited SHA-256 result is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8. If a tool disagrees with those, it is broken.
Where you will meet HMAC today
- JWT
HS256— the third segment of the token is exactly this function applied toheader.payload. - Webhook verification — Stripe, GitHub, Slack and Shopify all sign the raw request body with a shared secret.
- AWS Signature Version 4 — derives a signing key through a chain of HMACs before signing the canonical request.
- TOTP — the six-digit codes in your authenticator app are HMAC-SHA1 over a time counter, then truncated.
Verify a webhook signature by hand
- Read the signature header (for example
X-Hub-Signature-256) and the raw request body — not a re-serialised JSON copy. - Compute HMAC-SHA256 over the raw bytes with your endpoint secret.
- Compare the hex strings with a constant-time comparison, and reject if either the length or any byte differs.
- Reject any request whose timestamp is outside your tolerance window, otherwise a captured payload can be replayed forever.
How to use it
- Choose the underlying hash — SHA-256 is the common default.
- Paste your secret key.
- Paste the exact message bytes you want to authenticate.
- Copy the resulting hex signature.
Worth knowing
- Defined in RFC 2104; test vectors in RFC 2202 (MD5/SHA-1) and RFC 4231 (SHA-2).
- Block sizes: 64 bytes for MD5, SHA-1 and SHA-256; 128 bytes for SHA-512.
- Keys longer than the block size are hashed first; shorter keys are zero-padded.
- Output length always equals the underlying hash's output length.
Limitations
- HMAC proves integrity and key possession — it does not encrypt anything.
- The comparison must be constant-time; a byte-by-byte early-exit leaks the signature.
- Sign the raw bytes. Re-serialising JSON changes key order and whitespace and breaks verification.
- Rotating a leaked secret invalidates every signature issued under it.
Frequently asked questions
Should I use HMAC or a plain hash?
What is a length-extension attack?
H(secret ‖ message) and knowledge of the secret's length, an attacker can append data and compute a valid digest for the longer message without knowing the secret. HMAC's double-hash structure prevents it.