HMAC 생성기
SHA-256, SHA-384 또는 SHA-512를 사용하여 HMAC 서명을 생성합니다
다음 단계
관련된 다음 작업으로 흐름을 이어가세요.
Privacy & Trust
Browser-side signing
The message and secret stay in the browser while the HMAC is computed with the Web Crypto API.
Integrity, not encryption
HMAC proves authenticity and tamper resistance when both sides share the same secret. It does not hide the original message.
Secret reuse matters
Protect the signing key carefully and avoid sharing it between unrelated environments or products.
Export signature
Generate a signature to enable export.
사용 방법
값 입력
입력 필드에 숫자나 매개변수를 입력하세요.
즉시 결과 확인
입력하는 즉시 결과가 자동으로 업데이트됩니다 — 제출 버튼이 필요 없습니다.
복사 또는 저장
결과를 클립보드에 복사하거나 작업 흐름에 활용하세요.
이 도구를 사용하는 이유
100% 무료
숨겨진 비용도, 프리미엄 등급도 없습니다 — 모든 기능이 무료입니다.
설치 불필요
브라우저에서 완전히 실행됩니다. 소프트웨어를 다운로드하거나 설치할 필요가 없습니다.
프라이빗 & 안전
데이터가 기기 밖으로 나가지 않습니다. 어떤 서버에도 업로드되지 않습니다.
모바일 지원
완전 반응형 — 스마트폰, 태블릿, 데스크톱에서 사용할 수 있습니다.
HMAC: Hash-Based Message Authentication Codes
Key Takeaways
- HMAC combines a cryptographic hash function with a secret key to provide both data integrity and authentication.
- Unlike plain hashes, HMAC proves that the message was created by someone who knows the secret key — preventing tampering and forgery.
- All HMAC generation is performed in your browser using the Web Crypto API — your keys and data remain private.
HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the integrity and authenticity of a message. It is used extensively in API authentication (AWS Signature V4), webhook verification (GitHub, Stripe), and secure communication protocols. HMAC is more secure than simple hash verification because it requires knowledge of a shared secret key.
HMAC-SHA256 is used to authenticate over 1 billion API requests per day across major cloud platforms.
Scale of Use
Key Concepts
How HMAC Works
HMAC processes the key through two rounds of hashing with different padding (ipad and opad), making it resistant to length extension attacks that affect plain hash functions.
HMAC vs. Plain Hash
A plain hash (SHA-256 of a message) can be computed by anyone. HMAC requires the secret key, so only authorized parties can generate a valid MAC. This provides authentication in addition to integrity.
Webhook Signature Verification
Services like GitHub and Stripe sign webhook payloads with HMAC-SHA256 using a shared secret. The receiver recomputes the HMAC and compares it with the signature header to verify authenticity.
Timing-Safe Comparison
When verifying HMAC signatures, always use constant-time comparison functions to prevent timing attacks that could leak information about the expected value byte by byte.
Pro Tips
Use HMAC-SHA256 as your default — it offers an excellent balance of security and performance for most applications.
Keep HMAC keys at least as long as the hash output (32 bytes for SHA-256) for maximum security.
Rotate HMAC keys periodically and support multiple active keys during transition periods.
Never log or expose HMAC keys in error messages, URLs, or client-side code.
All HMAC computation is performed entirely in your browser using the Web Crypto API. Your secret keys and message data are never transmitted to any external server.