HMAC Generator

A Hash-based Message Authentication Code combines a secret key with a message and a hash function to produce a signature that proves the message was not altered and came from someone who knows the key.

A plain hash uses only the message, so anyone can compute it. An HMAC also mixes in a secret key, so only parties with the key can produce or verify it.

HMAC with SHA-256, SHA-512, SHA-1 and MD5. SHA-256 is the usual choice; avoid MD5 and SHA-1 for new security uses.

HMAC suits cases where the same secret is shared between the parties, such as verifying webhook payloads or API requests. Digital signatures with public and private keys are better when the verifier should not hold the signing secret.

Recompute the HMAC over the exact received payload using the shared secret and the provider algorithm, then compare it to the signature header using a constant-time comparison to avoid timing leaks.

Comparing signatures with an early-exit check can leak, through timing, how many leading bytes matched, which an attacker could exploit. A constant-time comparison takes the same time regardless of where a mismatch occurs.

Yes. HMAC-SHA256 is widely trusted and remains secure even though plain SHA-1 and MD5 are weak for other uses, because the HMAC construction does not depend on collision resistance in the same way.