Skip to content
SP

ScriptPulse

Developer Tools

Security Lab Tools
Password GeneratorPassword AnalyzerJWT InspectorHash GeneratorHMAC GeneratorUUID GeneratorEncryption StudioToken GeneratorBcrypt HasherRSA Key Pair GeneratorOTP Code GeneratorNano ID GeneratorULID GeneratorBIP39 Passphrase GeneratorView all Security Lab tools →

HMAC Generator

Compute HMAC values with selectable algorithms.

HMAC Generator

Runs entirely in your browser

This tool executes locally using standard browser APIs (for example window.crypto.getRandomValues or crypto.subtle where applicable). Your input is not transmitted to or stored on a ScriptPulse server. See How Calculations Work.

No data uploaded

What This Tool Does

  • The HMAC Generator is a browser-first security utility designed to compute Keyed-Hash Message Authentication Codes (HMAC) locally. An HMAC is a specific message authentication code that combines a cryptographic hash function with a secret key, verifying data integrity and authenticity. Unlike standard hashes which only verify that data has not been modified, an HMAC guarantees that the sender possesses the secret key, preventing attackers from tampering with payloads and recalculating signatures.
  • The utility prioritizes data security. Shared keys, messages, and signatures are processed in browser memory. No data is sent over the network or saved in external logs, protecting webhook signatures and API keys.

How It Works

  • The tool reads the payload message and secret key from the input fields.
  • The secret key is prepared: if the key is longer than the block size, it is hashed; if it is shorter, it is padded with zeros.
  • The engine XORs the padded key with an inner padding byte (ipad, 0x36) and appends the message payload, calculating an inner hash.
  • It then XORs the padded key with an outer padding byte (opad, 0x5C) and appends the inner hash digest, calculating the outer hash.
  • The binary digest is formatted as a hexadecimal string.

Usage

  1. Enter the message payload text in the source editor.
  2. Enter the secret key in the configuration field.
  3. Select your target cryptographic hash function (SHA-256, SHA-512, MD5, or SHA-1).
  4. Click the 'Generate HMAC' button to calculate the signature locally.
  5. Copy the hexadecimal signature to verify API headers.

Examples

  • Generating a SHA-256 signature: Signing `request_data` with key `secret_key` using SHA-256.
  • Verifying webhook payloads: Hashing JSON strings to check webhook signatures.
  • AWS SigV4 debugging: Computing intermediate keys and validating signatures.
  • Token signature verification: Validating JWT signature parameters.

Real-World Use Cases

  • Debugging API authentication headers by generating local HMAC signatures and comparing them against server signatures.
  • Verifying webhook authenticity (e.g. Stripe or GitHub) by simulating payload signing during development.
  • Implementing secure token validation mechanisms, such as JWT signature parsing.
  • Testing messaging signatures in IoT devices or server-to-server microservices.
  • Teaching keyed message authentication principles in security training.

Best Practices

  • Use keys with length equal to or greater than the output size of the chosen hash function.
  • Use constant-time comparison algorithms when verifying HMAC signatures on the server to prevent timing attacks.
  • Normalize message formats (e.g. stripping whitespace) before signing to ensure consistent outputs.
  • Use SHA-256 or SHA-512; avoid MD5 or SHA-1 except for legacy support.

Common Mistakes

  • Exposing the secret key in client logs or public commits, which allows attackers to impersonate clients.
  • Mismatching key or message formats: mixing text strings with hexadecimal representations can produce incorrect outputs.
  • Ignoring spacing: whitespace differences (like trailing newlines) will result in verification failures.
  • Using weak keys with low entropy, making signatures vulnerable to cracking.

Limitations

  • Only computes signatures; does not decrypt payloads or manage key lifecycles.
  • Input payload limit of 10MB to maintain browser responsiveness.
  • Calculations are client-side only; reloading the page clears the workspace.

Technical Reference Guide

  • RFC 2104: The official standard defining the HMAC algorithm, block padding, and cryptographic rationale.
  • Block Sizes: MD5 and SHA-256 block size is 64 bytes; SHA-512 block size is 128 bytes.
  • Security Strength: HMAC-SHA256 remains secure and is immune to length-extension attacks.

Specifications & Standards

RFC 2104: HMAC: Keyed-Hashing for Message AuthenticationFIPS PUB 198-1: The Keyed-Hash Message Authentication Code
Browse the full Standards & References library →

FAQ

  • What is the difference between HMAC and a standard hash?

    A standard hash takes only a message and checks its integrity. An HMAC takes both a message and a secret key, verifying both the data integrity and that the message was signed by someone who possesses the secret key.

  • Can I decrypt an HMAC signature?

    No. HMAC is a one-way signature verification mechanism. You cannot extract the message payload or the secret key from the HMAC signature.

  • Why is HMAC immune to length extension attacks?

    HMAC uses a nested double-hash construction (inner and outer steps with ipad/opad padding) that prevents attackers from appending data to a signed message and calculating a valid new signature.

  • How do webhooks use HMAC for validation?

    Webhook providers sign the request payload with a shared secret key and send the signature in a header (e.g., X-Hub-Signature). The receiver computes the HMAC of the raw request body using the same key and checks if it matches the header.

  • What key size should I use for HMAC-SHA256?

    The key should be at least 256 bits (32 bytes) of random data. Using keys smaller than the hash output size reduces the security strength of the authentication scheme.

  • Is it safe to compute HMAC signatures in this browser tool?

    Yes, all calculations are executed locally in your browser memory. Your keys and payloads are never transmitted to external systems.

  • What is a timing attack on HMAC verification?

    A timing attack exploits slight differences in execution time when comparing strings character-by-character. Using constant-time equality comparisons prevents attackers from guessing valid signatures byte-by-byte.

  • Does HMAC provide data encryption?

    No. HMAC only signs data to prove authenticity and integrity. The message payload itself remains readable.

  • Does this tool work offline?

    Yes. Once the page is loaded, the page assets are cached, allowing you to use all tools without an active internet connection.

  • Can I use public keys for HMAC?

    No. HMAC is a symmetric key algorithm. Both the signer and verifier must share the same secret key. For asymmetric key signatures, use RSA or ECDSA.

  • What is the output length of HMAC-SHA256?

    HMAC-SHA256 produces a 256-bit signature, represented as a 64-character hexadecimal string.

  • What is the difference between HS256 in JWT and HMAC?

    HS256 is the JWT name for the HMAC-SHA256 algorithm. It uses the same signature calculation step to sign the token payload.

Part of this Developer Hub

This utility is part of our comprehensive Hashing & Integrity topic workspace.

Explore foundational guidelines, technical specifications, and other interactive utilities related to this workflow.

Related Tools

Explore related utilities inside the Security Lab workshop for complementary engineering workflows.

Hash GeneratorBcrypt HasherJWT InspectorToken Generator
View all Security Lab tools