What is HMAC?
HMAC proves a message was not tampered with and came from someone who holds a shared secret. Learn how it works — it powers TOTP and JWT signing.
HMAC (Hash-based Message Authentication Code) combines a cryptographic hash with a secret key to produce a tag that proves both the integrity and the authenticity of a message. It underpins TOTP codes, JWT signatures, and webhook signing.
Hash alone is not enough
A plain hash proves data was not accidentally changed, but anyone can recompute it — so it does not prove who produced it. HMAC mixes in a secret key that only the legitimate parties know, so a valid tag proves the sender holds the key, not just that the data is intact.
How it is built
HMAC feeds the key and message through the hash twice with padding (inner and outer). Common variants are HMAC-SHA1, HMAC-SHA256, and HMAC-SHA512. TOTP uses HMAC-SHA1 over the time counter; JWTs with HS256 use HMAC-SHA256 over the header and payload.
Verifying webhooks
Providers (including Eveses) sign webhooks with HMAC: they send a signature header computed from the body and a shared secret. You recompute the HMAC on your side and compare — if they match, the webhook is authentic and untampered.
Try it now — free, no signup
Use the hash generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.