HMAC Generator

What is HMAC?

HMAC (Hash-based Message Authentication Code) is a construction that combines a cryptographic hash function with a secret key. It provides two properties:

• Integrity: Confirms the message hasn't been modified
• Authentication: Proves the sender knows the shared secret

The HMAC formula: HMAC(K, m) = H((K ⊕ opad) || H((K ⊕ ipad) || m))

Why Use HMAC Instead of Plain Hash?

A plain hash like SHA-256(message) only detects accidental changes. Anyone can recompute it. HMAC adds a secret key so only authorized parties can generate or verify the MAC.

Common Use Cases

• API Request Signing: AWS Signature V4, Stripe webhooks
• JWT Tokens: HS256 algorithm uses HMAC-SHA-256
• Webhook Verification: GitHub, Slack webhook signatures
• Key Derivation: HKDF uses HMAC internally
• VPN/IPsec: Integrity protection in network protocols

Key Strength Recommendations

• HMAC-SHA-256: Use 256-bit (32 byte) keys
• HMAC-SHA-512: Use 512-bit (64 byte) keys
• Minimum: 128-bit (16 byte) random key
• Always use cryptographic random generator

Python

import hmac
import hashlib

key = b'secret-key'
message = b'Hello, World!'
signature = hmac.new(key, message, hashlib.sha256).hexdigest()
print(signature)

Node.js

const crypto = require('crypto');

const key = 'secret-key';
const message = 'Hello, World!';
const hmac = crypto.createHmac('sha256', key)
                   .update(message).digest('hex');
console.log(hmac);