Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
What HMAC adds to a plain hash
An HMAC (keyed-hash message authentication code) mixes a secret key into the hashing process. Where SHA-256 of a message proves only that the bytes did not change, an HMAC also proves that whoever produced it knew the shared key, so a server can trust that an incoming webhook really came from the expected sender. With the key key and the message The quick brown fox jumps over the lazy dog, HMAC-SHA256 returns f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.
A plain hash is not enough for authentication: anyone can recompute SHA-256, so an attacker could forge a digest. HMAC is designed to resist that, including the length-extension attacks that break naive hash(secret + message) schemes. Use HMAC-SHA256 to sign API requests, verify webhooks (Stripe, GitHub, Slack) and derive per-message tokens. The key must stay secret and be long and random.
How to compute an HMAC
- Pick the HMAC algorithm: SHA-1, SHA-256 or SHA-512.
- Enter the secret key in the masked key field.
- Type or paste the message to authenticate.
- Compare the signature with the one your server receives.
Frequently asked questions about HMAC
Why does HMAC need a key?
The key is what turns a public fingerprint into an authentication proof: only parties that share the secret can produce a matching MAC.
HMAC-SHA1 or HMAC-SHA256?
HMAC-SHA256 is the modern default for webhooks and request signing. HMAC-SHA1 still appears in older protocols and is acceptable when required for compatibility.
Is HMAC encryption?
No. It does not hide the message — it only proves integrity and authenticity. Encrypt separately if confidentiality is needed.
Runs entirely in your browser: your input, the HMAC key and the expected hash never leave this device.
