HMAC vs digital signature — what's the difference?

HMAC uses a shared secret key — both sender and receiver can sign, so it proves authenticity only to parties who already have the key. Digital signatures use asymmetric keys — only the private key holder can sign, anyone with the public key can verify.

Which hash algorithm should I use for HMAC?

SHA-256 is the modern default. SHA-1 is deprecated but HMAC-SHA1 is still considered secure (HMAC's construction protects against SHA-1's collision weakness). Avoid MD5-based HMAC for new systems.

TASK

Generate an HMAC and verify a message's authenticity

Compute a keyed-hash (HMAC) of a message to prove it came from someone sharing the secret, then verify a received HMAC.

1

HMAC combines a secret key with a hash function to produce a tag that proves both integrity and authenticity. Only someone with the same key can produce or verify the tag. It is used in webhooks, API signing, and JWT HS256.
2

HMAC Generator →
Enter the message and secret key, choose a hash algorithm (SHA-256 recommended). The tool outputs the HMAC tag as hex or Base64.
3

hmac-generator
View recipe Open in Toolchain

Use the sign-and-verify chain: sign a message, then verify it against a correct and a tampered message to see pass/fail in one run.
4

When verifying a received webhook, recompute the HMAC over the raw request body with your shared secret and compare in constant time. Never use == which is vulnerable to timing attacks.

Frequently asked questions

HMAC vs digital signature — what's the difference?: HMAC uses a shared secret key — both sender and receiver can sign, so it proves authenticity only to parties who already have the key. Digital signatures use asymmetric keys — only the private key holder can sign, anyone with the public key can verify.
Which hash algorithm should I use for HMAC?: SHA-256 is the modern default. SHA-1 is deprecated but HMAC-SHA1 is still considered secure (HMAC's construction protects against SHA-1's collision weakness). Avoid MD5-based HMAC for new systems.