Question 1

What is HMAC?

Accepted Answer

HMAC (Hash-based Message Authentication Code) is a construction defined in RFC 2104 that combines a cryptographic hash function with a secret key to produce a message authenticator. Given a message M and a key K, HMAC outputs hash(K ⊕ outer_pad || hash(K ⊕ inner_pad || M)). The double-hash design protects against length-extension attacks that affect Merkle-Damgård hashes when keys are simply concatenated. HMAC is used for API request signing (AWS SigV4, GitHub webhooks, Stripe webhooks), JWT signing (HS256/HS384/HS512), TLS message authentication, OAuth signed requests, and any context where you need to prove a message wasn't tampered with by an attacker who lacks the secret.

Question 2

Which HMAC variant should I use?

Accepted Answer

HMAC-SHA-256 is the modern default, fast, secure, ubiquitous. Use HMAC-SHA-512 when you need 256+ bit security margins or you're already using SHA-512 elsewhere. HMAC-SHA-1 is still considered safe (RFC 6194) but is deprecated for new protocols. Migrate to SHA-256 if you control both sides. HMAC-MD5 is similarly still safe but heavily deprecated; the only place it's still common is legacy challenge-response auth like CRAM-MD5 SMTP. Don't pick HMAC-MD5 for anything new.

Question 3

How is HMAC different from just hashing key+message?

Accepted Answer

Plain hash(key || message) is vulnerable to length-extension attacks against Merkle-Damgård hashes (MD5, SHA-1, SHA-2). An attacker who knows hash(key || message) can compute hash(key || message || padding || extra) without knowing the key, because the hash function's internal state at the end of the first hash is fully recoverable from the output. HMAC's double-hash structure (with different inner and outer pad constants XORed into the key) breaks this. The attacker can't compute the second hash without the key. HMAC also provides better security proofs and resistance to weak-key attacks.

Question 4

How long should my HMAC key be?

Accepted Answer

Equal to or greater than the hash output size, ideally generated by a CSPRNG. For HMAC-SHA-256: 32 bytes (256 bits). For HMAC-SHA-512: 64 bytes. Keys shorter than the block size are zero-padded; keys longer than the block size are first hashed. There's no harm in using a longer key. Don't use human-chosen passwords as HMAC keys, they have too little entropy. If you must derive an HMAC key from a password, run the password through PBKDF2 or HKDF first to produce a uniformly random key.

HMAC Generator

Frequently Asked Questions