HMAC Generator

What is an HMAC?

An HMAC is a message authentication code: a tag from your data and a secret key that proves both who produced the message and that it has not changed. Anyone can hash data. Only a holder of the key can produce a valid HMAC over it.

• Secret key (hex): required. Hexadecimal bytes of the shared secret.
• Message: typed text or a file.
• Hash algorithm: SHA-256 by default, plus SHA-384, SHA-512, SHA3-256, and SHA3-512. SHA-256 is the usual pick for interoperability.

The result is the tag in hexadecimal, plus the algorithm used.

Why not just hash the key and the message together

The obvious construction is broken. Hashing a secret followed by a message and publishing the result lets an attacker append data and compute a valid tag for the longer message without ever knowing the key, using the length-extension property of SHA-256 and SHA-512.

HMAC nests two hash operations with the key mixed in differently each time. That closes the hole for any underlying hash, which is why the standard construction is worth using rather than inventing your own.

Are there alternatives?

HMAC Verifier is the other half of this pair, for checking a tag rather than producing one.

If you need confidentiality as well as authenticity, an HMAC alone is the wrong shape. An AEAD such as AES-GCM or ChaCha20-Poly1305 does both in one operation and is harder to combine incorrectly. If you need to prove authorship to someone who does not share your key, no MAC can do that, because verification requires the same secret.

Fun facts and more info

Verification needs the key, the message, and the algorithm to match exactly. Changing any of the three produces a completely different tag, and a mismatch tells you nothing about which one was wrong.

Keep the key secret. An HMAC authenticates data without concealing it, so the message travels in the clear and anyone can read it. What they cannot do is alter it undetected.