Question 1

What is HMAC?

Accepted Answer

HMAC (Hash-based Message Authentication Code) is a construction defined in RFC 2104 that combines a cryptographic hash function with a secret key to produce a message authenticator. Given a message M and a key K, HMAC outputs hash(K ⊕ outer_pad || hash(K ⊕ inner_pad || M)). The double-hash design protects against length-extension attacks that affect Merkle-Damgård hashes when keys are simply concatenated. HMAC is used for API request signing (AWS SigV4, GitHub webhooks, Stripe webhooks), JWT signing (HS256/HS384/HS512), TLS message authentication, OAuth signed requests, and any context where you need to prove a message wasn't tampered with by an attacker who lacks the secret.

Question 2

Which HMAC variant should I use?

Accepted Answer

HMAC-SHA-256 is the modern default — fast, secure, ubiquitous. Use HMAC-SHA-512 when you need 256+ bit security margins or you're already using SHA-512 elsewhere. HMAC-SHA-1 is still considered safe (RFC 6194) but is deprecated for new protocols — migrate to SHA-256 if you control both sides. HMAC-MD5 is similarly still safe but heavily deprecated; the only place it's still common is legacy challenge-response auth like CRAM-MD5 SMTP. Don't pick HMAC-MD5 for anything new.

Question 3

How is HMAC different from just hashing key+message?

Accepted Answer

Plain hash(key || message) is vulnerable to length-extension attacks against Merkle-Damgård hashes (MD5, SHA-1, SHA-2). An attacker who knows hash(key || message) can compute hash(key || message || padding || extra) without knowing the key, because the hash function's internal state at the end of the first hash is fully recoverable from the output. HMAC's double-hash structure (with different inner and outer pad constants XORed into the key) breaks this — the attacker can't compute the second hash without the key. HMAC also provides better security proofs and resistance to weak-key attacks.

Question 4

How long should my HMAC key be?

Accepted Answer

Equal to or greater than the hash output size, ideally generated by a CSPRNG. For HMAC-SHA-256: 32 bytes (256 bits). For HMAC-SHA-512: 64 bytes. Keys shorter than the block size are zero-padded; keys longer than the block size are first hashed. There's no harm in using a longer key. Don't use human-chosen passwords as HMAC keys — they have too little entropy. If you must derive an HMAC key from a password, run the password through PBKDF2 or HKDF first to produce a uniformly random key.

HMAC Generator

Frequently Asked Questions