Gerador HMAC
Gere assinaturas HMAC usando SHA-256, SHA-384 ou SHA-512
O que é HMAC?
HMAC (Código de Autenticação de Mensagem Baseado em Hash) verifica a integridade e autenticidade dos dados usando uma chave secreta combinada com uma função hash.
Ferramentas Relacionadas
Gerador de Hash
Gere hashes SHA-1, SHA-256, SHA-384, SHA-512
Gerador de Senhas
Gere senhas aleatórias fortes e seguras
Decodificador JWT
Decodificar e inspecionar JSON Web Tokens
Gerador de Token / Segredo
Gere tokens aleatórios, chaves de API e segredos em vários formatos
Gerador de Hash Bcrypt
Criptografe senhas com bcrypt e verifique hashes
Formatador JSON
Embeleze, minifique e valide dados JSON
Como Usar
Insira Seus Valores
Preencha os campos de entrada com seus números ou parâmetros.
Obtenha Resultados Instantâneos
Os resultados são atualizados automaticamente enquanto você digita — sem botão de envio necessário.
Copie ou Salve
Copie os resultados para a área de transferência ou use-os no seu fluxo de trabalho.
Por Que Usar Esta Ferramenta
100% Gratuito
Sem custos ocultos, sem planos premium — todos os recursos são gratuitos.
Sem Instalação
Funciona inteiramente no seu navegador. Nenhum software para baixar ou instalar.
Privado e Seguro
Seus dados nunca saem do seu dispositivo. Nada é enviado a nenhum servidor.
Funciona no Celular
Totalmente responsivo — use no seu celular, tablet ou desktop.
HMAC: Hash-Based Message Authentication Codes
Key Takeaways
- HMAC combines a cryptographic hash function with a secret key to provide both data integrity and authentication.
- Unlike plain hashes, HMAC proves that the message was created by someone who knows the secret key — preventing tampering and forgery.
- All HMAC generation is performed in your browser using the Web Crypto API — your keys and data remain private.
HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the integrity and authenticity of a message. It is used extensively in API authentication (AWS Signature V4), webhook verification (GitHub, Stripe), and secure communication protocols. HMAC is more secure than simple hash verification because it requires knowledge of a shared secret key.
HMAC-SHA256 is used to authenticate over 1 billion API requests per day across major cloud platforms.
Scale of Use
Key Concepts
How HMAC Works
HMAC processes the key through two rounds of hashing with different padding (ipad and opad), making it resistant to length extension attacks that affect plain hash functions.
HMAC vs. Plain Hash
A plain hash (SHA-256 of a message) can be computed by anyone. HMAC requires the secret key, so only authorized parties can generate a valid MAC. This provides authentication in addition to integrity.
Webhook Signature Verification
Services like GitHub and Stripe sign webhook payloads with HMAC-SHA256 using a shared secret. The receiver recomputes the HMAC and compares it with the signature header to verify authenticity.
Timing-Safe Comparison
When verifying HMAC signatures, always use constant-time comparison functions to prevent timing attacks that could leak information about the expected value byte by byte.
Pro Tips
Use HMAC-SHA256 as your default — it offers an excellent balance of security and performance for most applications.
Keep HMAC keys at least as long as the hash output (32 bytes for SHA-256) for maximum security.
Rotate HMAC keys periodically and support multiple active keys during transition periods.
Never log or expose HMAC keys in error messages, URLs, or client-side code.
All HMAC computation is performed entirely in your browser using the Web Crypto API. Your secret keys and message data are never transmitted to any external server.