Free HMAC Generator (Message Authentication)

A hash provides data integrity - detecting changes. HMAC provides integrity plus authentication - proving the message came from someone with the secret key. Without the key, valid HMACs cannot be forged.

HMAC-SHA256 is the standard recommendation for new applications. HMAC-SHA512 for extra security margin. Avoid HMAC-MD5/SHA1 for new systems unless required for legacy compatibility.

Keys should be at least as long as the hash output (32 bytes for HMAC-SHA256, 64 bytes for HMAC-SHA512). Longer keys do not add security. Use cryptographically random bytes, not passwords.

Passwords make weak HMAC keys due to low entropy. Use cryptographically random bytes instead. If you must derive a key from a password, use a proper key derivation function like PBKDF2 or HKDF.

APIs use HMAC to authenticate requests. The client signs request data with their secret key. The server verifies the signature, confirming the request came from a legitimate client with the correct key.

HMAC provides additional security beyond the underlying hash, making HMAC-MD5 and HMAC-SHA1 more secure than raw MD5/SHA-1. However, use HMAC-SHA256 for new systems to avoid any questions about algorithm strength.