How to generate an HMAC
- Type or paste the message into Message, exactly as it is signed: spaces and line breaks count.
- Type the Secret key and say whether it's plain text, hex or Base64. Pick the hash, usually SHA-256.
- Copy the HMAC as hex or Base64, whichever the service you're checking uses.
HMAC versus a plain hash
A plain hash such as SHA-256 proves a file hasn’t changed only if you trust where you got the hash from. Anyone who changes a message can also recompute its plain hash. An HMAC mixes in a secret, so only someone with that secret can produce a matching code. That’s why APIs, webhooks and session cookies use HMACs rather than plain hashes to prove a message is genuine.
Which hash to choose
Use what the other side expects. HMAC-SHA256 is the most common choice today and is what JWTs with HS256, AWS request signing and most webhooks use. HMAC-SHA512 gives a longer code. HMAC-SHA1 is still found in older systems; SHA-1’s known collision attacks don’t break HMAC-SHA1, but new designs should use SHA-256.
The key can be any length. Keys longer than the hash’s block size (64 bytes for SHA-256, 128 bytes for SHA-512) are hashed first, as the standard says, so they work too.