Keys for message authentication
An HMAC proves that a message came from someone who knows the key and was not changed on the way. It is used to sign webhooks, API requests, cookies and tokens. The key should be random and at least as long as the hash output: 32 bytes for HMAC-SHA256, 48 for SHA-384 and 64 for SHA-512.
Below the generator, the calculator signs any message with the key, so you can produce test vectors or debug a signature mismatch without sending data anywhere.
Avoiding common mistakes
- Sign the exact bytes that are sent. Re-serializing JSON can change spacing and key order and break the signature.
- Compare signatures with a constant-time function, not ==.
- Agree on encoding. Hex and Base64 signatures of the same HMAC look completely different.
Frequently asked questions
How long should an HMAC key be?
At least the hash length: 32 bytes for HMAC-SHA256. Longer keys are allowed but do not add meaningful strength.
Is HMAC the same as hashing the key and message together?
No. Hashing the key plus the message with SHA-256 is open to length extension attacks. HMAC’s construction prevents that, so always use a real HMAC function.