HMAC (Hash-based Message Authentication Code) combines a secret key with a message to produce a signature. It provides both data integrity and authenticity verification.

Regular hashes only verify data integrity. HMAC includes a secret key, so only parties knowing the key can create or verify the signature, providing authentication.

SHA-256, SHA-384, and SHA-512 from the SHA-2 family. These are the most common and secure options for HMAC in modern applications.

API authentication (AWS, Stripe), webhook verification, JWT signing, secure cookies, and message authentication in protocols like TLS and IPsec.

Use a cryptographically random key at least as long as the hash output (32+ bytes for HMAC-SHA256). Never use predictable values like timestamps or user IDs.

Yes. All computation uses the Web Crypto API in your browser. Your secret key and message never leave your device.

No. HMAC is a one-way function. Even with the message and HMAC value, the secret key cannot be recovered (assuming a strong key).

HMAC output matches the underlying hash: SHA-256 produces 64 hex characters (32 bytes), SHA-384 produces 96 hex characters, SHA-512 produces 128 hex characters.

HMAC is symmetric (same key to sign and verify). Digital signatures (RSA, ECDSA) are asymmetric. Use HMAC when both parties share a secret; signatures when they don't.

Compute HMAC with the same key and message, then compare with the received value. Use constant-time comparison to prevent timing attacks.

Related Tools