How HMAC differs from a plain hash
A regular hash (see Hash Generator) takes a message and produces a fingerprint — anyone can recompute it, so it only proves the message wasn't altered, not who sent it. HMAC (Hash-based Message Authentication Code) mixes a secret key into that process, so the resulting value proves two things at once: the message wasn't altered, and it was produced by someone who holds the key. That combination — integrity plus authenticity — is what makes HMAC the standard way to sign webhook payloads, API requests, and tokens.
Where you'll see it
- JWTs signed with HS256/384/512 — the "HS" literally stands for HMAC-SHA. The signature segment of a JWT is an HMAC over the header and payload, computed with the issuer's secret. See JWT Signature Verifier to check one.
- Webhook signature verification — services like Stripe and GitHub send an HMAC of the request body in a header, so the receiver can confirm the payload actually came from them and wasn't tampered with in transit.
- API request signing — signing a canonicalized request with a shared secret so the server can reject anything not signed by a legitimate client.
Which algorithm to use
The same guidance as plain hashing applies: prefer HMAC-SHA256 as the default. HMAC-MD5 and HMAC-SHA1 are included here for compatibility with older systems, but MD5 and SHA-1's known weaknesses as hash functions (see MD5 vs SHA-256 vs SHA-512) mean HMAC-SHA256 or HMAC-SHA512 are the safer choice for anything new.
One important note: HMAC is not a password hashing algorithm. It's fast by design, same as the underlying hash function — exactly the wrong property for storing passwords. See Password Hashing Explained for what to use instead.
How this is computed
HMAC-SHA1/256/512 use the browser's native Web Crypto API (crypto.subtle.sign). HMAC-MD5 is built from this site's pure-JavaScript MD5 implementation using the standard HMAC construction (RFC 2104) directly, since Web Crypto doesn't implement MD5 at all. Your message and key are both processed locally and never leave your browser.