HMAC Generator
Generate HMAC (Hash-based Message Authentication Code) signatures for API authentication and message integrity verification. HMAC combines a cryptographic hash with a secret key to create unforgeable signatures.
Understanding HMAC
| Property | Description | PurposeMessage authentication ComponentsMessage + Secret key + Hash OutputFixed-size signature SecurityProves message origin & integrity
HMAC vs Plain Hashing
FeaturePlain HashHMAC Uses secret keyNoYes Verifies senderNoYes Prevents tamperingDetectsDetects + authenticates | API security | Insufficient | Recommended |
HMAC Implementation
``javascript
// Node.js
const crypto = require('crypto');
function generateHmac(message, secret, algorithm = 'sha256') {
return crypto
.createHmac(algorithm, secret)
.update(message)
.digest('hex');
}
// Example
const signature = generateHmac('Hello World', 'my-secret-key');
// "a1b2c3d4e5f6..."
// Verify HMAC
function verifyHmac(message, secret, signature) {
const expected = generateHmac(message, secret);
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
}
`
Web Crypto API (Browser)
`javascript
async function generateHmacBrowser(message, secret) {
const encoder = new TextEncoder();
const key = await crypto.subtle.importKey(
'raw',
encoder.encode(secret),
{ name: 'HMAC', hash: 'SHA-256' },
false,
['sign']
);
const signature = await crypto.subtle.sign(
'HMAC',
key,
encoder.encode(message)
);
return Array.from(new Uint8Array(signature))
.map(b => b.toString(16).padStart(2, '0'))
.join('');
}
`
API Request Signing
`javascript
// Sign an API request
function signRequest(method, path, body, timestamp, secret) {
const message = ${method}\n${path}\n${timestamp}\n${body};
return generateHmac(message, secret);
}
// Example
const signature = signRequest(
'POST',
'/api/orders',
JSON.stringify({ item: 'book', qty: 1 }),
Date.now().toString(),
'api-secret-key'
);
``
Common HMAC Algorithms
| Algorithm | Security | Use Case | HMAC-MD5WeakLegacy only HMAC-SHA1AcceptableOAuth 1.0 HMAC-SHA256StrongAWS, Stripe, most APIs HMAC-SHA512Very strongHigh-security needs