HMAC-SHA256, HMAC-SHA384, and HMAC-SHA512 message authentication. Visualize the inner/outer key padding (ipad/opad), demonstrate tamper detection, and truncate the output to a chosen length.
Recommended: 32 random bytes (64 hex chars). Shorter keys are zero-padded; longer keys are pre-hashed.
An HMAC answers one question: does this message come from someone who knows the key, and has it been modified in transit? The "tamper detection" tab shows this directly — same key, slightly different message, completely different tag. That's the property you rely on for JWT signing, API request signing, and message authentication in TLS.
The ipad/opad tab exposes what most HMAC libraries hide: HMAC = hash((key ⊕ opad) || hash((key ⊕ ipad) || message)). Two nested hash invocations with the key XOR'd against two different constants. The inner hash produces a fixed-size intermediate, the outer hash produces the final tag. This double-hash construction defeats length-extension attacks that would break naive hash(key || message).
The truncate option lets you cut the HMAC to a shorter length. RFC 2104 allows truncation for specific scenarios (e.g., RFID tags where every byte is expensive), but warns that halving the tag roughly squares the forgery probability. We display the warning inline so you don't accidentally weaken your security.
All HMAC computation goes through Web Crypto's crypto.subtle.sign('HMAC', ...), which delegates to the OS-native implementation. This is the same primitive used by AWS Signature V4, JWT, and OAuth.
You sign API requests with HMAC-SHA256 (or HMAC-SHA512 for FIPS). This tool lets you reproduce the server-side calculation when debugging mismatches. Paste the key and request body, get the expected signature, compare against what your client sent.
You encounter a protocol that uses HMAC with non-standard parameters (truncated, wrong hash, custom encoding). This tool lets you replicate the exact construction to verify it's implemented as documented.
HMAC is the textbook example of a secure Message Authentication Code. Watching the ipad/opad bytes appear makes the construction concrete in a way that a paper cannot.
hash(key || message) is vulnerable to length-extension attacks. If the attacker knows hash(key || message) and the length of key, they can compute hash(key || message || extra) without knowing the key. This works against SHA-256, SHA-512, and other Merkle–Damgård hashes. HMAC's double-hash with ipad/opad defeats this — the attacker can't compute the intermediate state because the outer hash absorbs it. The exact security proof is in RFC 2104.
hash(key). If key length < block size, the key is zero-padded to block size. Our tool follows this exactly. You can see the zero-padding on the ipad/opad tab by entering a short key — the right-hand bytes of ipad-key and opad-key will be the original key XOR'd with the constant, and the remaining bytes will be the constant alone (since 0 XOR 0x36 = 0x36, 0 XOR 0x5C = 0x5C).