HMAC / MAC
Professional client-side keyed-hash message authentication code suite supporting HMAC-SHA256, SHA512, SHA384, SHA224, SHA1 and MD5 with Web Crypto native acceleration and constant-time verification.
What Is HMAC?
HMAC (Hash-based Message Authentication Code) combines a secret key with a hash function to produce a code that proves both that a message hasn't changed and that it was created by someone who holds the shared key — unlike a plain hash, which anyone can compute.
How to Use the HMAC / MAC Tool
- Enter the message and the secret key.
- Choose a hash algorithm to use with HMAC (SHA-256 and others are available).
- Generate the MAC, or paste an existing MAC alongside a message and key to verify it matches.
Technical Notes
- HMAC requires a secret key — without one, it's just a regular hash and provides no authentication guarantee.
- The same message and key always produce the same MAC, so verification means recomputing the MAC and comparing it, not decrypting anything.
- Keep the secret key private; anyone who has it can generate valid MACs indistinguishable from yours.
Frequently Asked Questions
How is HMAC different from a plain hash?+
A plain hash can be computed by anyone, so it only detects accidental changes. HMAC mixes in a secret key, so a valid tag also proves the message came from someone who holds that key. Without a key it provides no authentication.
How do I verify a MAC — can it be decrypted?+
A MAC is not encryption and cannot be reversed. Verification means recomputing the HMAC over the received message and key and comparing it to the expected tag. This tool performs that comparison in constant time to avoid timing side channels.
Is HMAC-MD5 or HMAC-SHA1 safe to use?+
The collision weaknesses of MD5 and SHA-1 do not directly break HMAC, so these variants still appear in some legacy protocols such as older AWS signatures and OAuth 1.0. For anything new, use HMAC-SHA-256 or stronger.