Encryption / Hash

HMAC Calculator

Compute HMAC message authentication codes with SHA-1/SHA-256/SHA-384/SHA-512.

Input text
Secret key
Algorithm:
HMAC Result
Waiting for input...

What is HMAC?

HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to verify data integrity and authenticity.

Supported Algorithms

  • HMAC-MD5
  • HMAC-SHA1
  • HMAC-SHA256
  • HMAC-SHA384
  • HMAC-SHA512

Use Cases

  • API authentication signatures
  • Message integrity verification
  • Webhook validation

Frequently Asked Questions

How is HMAC different from a plain hash?
Anyone can compute a plain hash; HMAC is keyed — only holders of the secret can produce or verify it. That is why API request signing and webhook verification (GitHub, Stripe) use HMAC: the receiver recomputes it with the shared key to confirm both origin and integrity.
Why must HMAC comparison use constant time?
A normal === comparison returns at the first mismatched character, letting attackers deduce the correct signature byte by byte by measuring response times (timing attack). Use crypto.timingSafeEqual or your language’s constant-time comparison in real code.
Can HMAC replace password hashing?
No. HMAC is fast, which makes GPU brute force cheap. Password storage needs deliberately slow hashes (bcrypt, Argon2id, PBKDF2). HMAC’s job is message authentication, not credential storage.