What is HMAC?
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash function with a secret key to produce a signature. It proves a message was not altered and came from someone who holds the key.
HMAC is widely used to sign API requests and webhooks (e.g. HMAC-SHA256). Unlike a plain hash, an attacker cannot forge a valid HMAC without the secret key.
Key points
- Combines a hash function with a shared secret key.
- Proves both integrity and authenticity of a message.
- An attacker cannot forge it without the secret key.
- Commonly written as HMAC-SHA256.
Example
HMAC-SHA256(secret, message) → a 64-character hex signature
Common uses
- Signing and verifying webhooks (Stripe, GitHub, etc.)
- Authenticating API requests
- Protecting session cookies from tampering
- Verifying message integrity in transit
Work with HMAC directly in your browser.
Open the HMAC Generator