HMAC Generator
Generate HMAC (Hash-based Message Authentication Code) signatures for API authentication and message integrity verification. HMAC combines a cryptographic hash with a secret key to create unforgeable signatures.
Understanding HMAC
| Property | Description |
|---|---|
| Purpose | Message authentication |
| Components | Message + Secret key + Hash |
| Output | Fixed-size signature |
| Security | Proves message origin & integrity |
HMAC vs Plain Hashing
| Feature | Plain Hash | HMAC |
|---|---|---|
| Uses secret key | No | Yes |
| Verifies sender | No | Yes |
| Prevents tampering | Detects | Detects + authenticates |
| API security | Insufficient | Recommended |
HMAC Implementation
``javascript
// Node.js
const crypto = require('crypto');
function generateHmac(message, secret, algorithm = 'sha256') {
return crypto
.createHmac(algorithm, secret)
.update(message)
.digest('hex');
}
// Example
const signature = generateHmac('Hello World', 'my-secret-key');
// "a1b2c3d4e5f6..."
// Verify HMAC
function verifyHmac(message, secret, signature) {
const expected = generateHmac(message, secret);
return crypto.timingSafeEqual(
Buffer.from(signature),
Buffer.from(expected)
);
}
`
Web Crypto API (Browser)
`javascript
async function generateHmacBrowser(message, secret) {
const encoder = new TextEncoder();
const key = await crypto.subtle.importKey(
'raw',
encoder.encode(secret),
{ name: 'HMAC', hash: 'SHA-256' },
false,
['sign']
);
const signature = await crypto.subtle.sign(
'HMAC',
key,
encoder.encode(message)
);
return Array.from(new Uint8Array(signature))
.map(b => b.toString(16).padStart(2, '0'))
.join('');
}
`
API Request Signing
`javascript
// Sign an API request
function signRequest(method, path, body, timestamp, secret) {
const message = ${method}\n${path}\n${timestamp}\n${body};
return generateHmac(message, secret);
}
// Example
const signature = signRequest(
'POST',
'/api/orders',
JSON.stringify({ item: 'book', qty: 1 }),
Date.now().toString(),
'api-secret-key'
);
``
Common HMAC Algorithms
| Algorithm | Security | Use Case |
|---|---|---|
| HMAC-MD5 | Weak | Legacy only |
| HMAC-SHA1 | Acceptable | OAuth 1.0 |
| HMAC-SHA256 | Strong | AWS, Stripe, most APIs |
| HMAC-SHA512 | Very strong | High-security needs |