What Is HMAC Used For? Why APIs Need Signed Requests

What is HMAC used for? HMAC, hash based message authentication code, is used to prove a request or payload came from someone holding a shared secret key and was not altered in transit. A plain hash only detects accidental corruption and can be recomputed by anyone, since it uses no secret at all. That difference is exactly why APIs, webhooks, and signed URLs rely on HMAC instead of a bare hash whenever they need to trust the source of a message, not just check that the bytes arrived intact.

A plain hash and an HMAC solve different problems

A plain hash function, like SHA256 on its own, takes any input and produces a fixed length digest. Change one character in the input and the digest changes completely. That property makes plain hashes great for checking that a file downloaded correctly, or that two copies of a document are identical. You can compute a hash with our hash generator and compare it against a published checksum in seconds.

The problem is that a plain hash carries no secret. Anyone, including an attacker sitting between a client and a server, can take a payload, run it through SHA256, and produce the exact same digest you would. So if a server only checks "does the hash match," it has confirmed the payload was not corrupted by a network glitch, but it has confirmed nothing about who sent it. An attacker who intercepts a request, changes the amount field in a payment, and recomputes the hash will produce a digest that still matches the tampered body perfectly.

Where the secret key changes everything

HMAC fixes this by mixing a shared secret key into the hashing process itself. Instead of hashing just the message, HMAC combines the key and the message through two nested hash operations, roughly hash(key XOR opad, hash(key XOR ipad, message)) using whichever underlying hash function you choose, commonly SHA256. The output, called a signature or a tag, depends on both the message and the key. Change either one and the signature is different.

This is what HMAC is used for in practice: only someone who knows the secret key can produce a signature that the receiving server will accept. An attacker who intercepts a request can still read it, and can still change it, but cannot forge a valid signature for the altered version without the key. The server recomputes the expected signature using its own copy of the secret and compares it against the one attached to the request. If they match, the server trusts both that the sender knows the secret and that the payload was not modified after signing.

A concrete example: verifying a webhook from a payment provider

Most payment processors send webhooks to notify your server about events like a completed charge or a refund. Because these webhooks trigger real actions, such as marking an order paid or releasing a shipment, you cannot just trust whatever hits your endpoint. Anyone who guesses your webhook URL could send a fake "payment succeeded" event otherwise.

To prevent that, the provider signs each webhook body with HMAC using a secret only your account and the provider know. The request typically arrives with a header like this:

X_SIGNATURE: t=1700000000, v1=5257a869e7...

Your server takes the raw request body, runs it through HMAC SHA256 with your webhook secret, and checks the result against the v1 value in the header. If they match, the event is genuine and unaltered, so you process it. If they do not match, you reject the request outright, no matter how legitimate the payload looks. This single check is what stops a forged "refund issued" event from draining your ledger.

Constant time comparison matters too

One detail teams get wrong is comparing signatures with a normal string equality check. A naive comparison can exit early on the first mismatched byte, and the tiny timing difference between failing at byte one versus byte thirty can, in theory, leak information to an attacker probing many requests. Proper implementations use a constant time comparison function so every check takes the same amount of time regardless of where the mismatch occurs. Most standard libraries ship one specifically for this purpose, so use it rather than writing your own comparison loop.

HMAC compared to other things that look similar

It helps to separate HMAC from a few adjacent concepts. A JSON Web Token, which you can inspect with our JWT decoder, often uses HMAC internally as one of its signing algorithms, specifically HS256. But a JWT is a container format for claims, while HMAC is the signing mechanism that protects the token from tampering. You can have HMAC without JWT, such as signing a webhook body directly, and JWT without HMAC, if the token uses RSA or ECDSA signatures instead.

Base64 encoding is another thing people sometimes confuse with security. Encoding a signature with our base64 encoder just changes how bytes are represented as text so they survive transport in a URL or header. It adds no secrecy and no integrity guarantee on its own. HMAC provides the actual protection; base64 is just packaging.

Password hashing is a separate case again. When you store user passwords, you want a slow, salted hash designed to resist brute force, not HMAC. Our password strength checker is useful for the input side of that problem, but the storage mechanism itself is a different topic from request signing entirely.

Why not just encrypt the request instead

Encryption and HMAC solve different problems too. Encryption keeps content secret from anyone without the decryption key. HMAC does not hide anything, since the message can travel in plain text alongside its signature. What HMAC guarantees is authenticity and integrity: this message came from someone with the key, and it has not changed since they signed it. Many systems run over HTTPS, which already provides transport encryption, and then add HMAC on top so the application layer itself can verify sender identity even if something further up the chain terminates or re originates the connection. The two mechanisms are complementary, not substitutes for each other.

The formal definition of HMAC comes from RFC 2104, published by the IETF, which specifies exactly how the key and message get combined with the underlying hash function. If you want the precise construction rather than a summary, that document is the primary source.

Tools that pair with HMAC

HMAC rarely shows up alone. If you need a plain checksum for a file or string, the hash generator handles that without a secret key. If a signed token is involved, the JWT decoder lets you inspect the header, payload, and signing algorithm at a glance. When a signature or key needs to travel as text, the base64 encoder handles the encoding side. And if you are reviewing account security more broadly, the password strength checker is a good companion check. You can browse the full set of tools or read more explainers on the ConvertNow blog.

HMAC in one paragraph

A plain hash proves a message was not corrupted, but anyone can compute one, so it proves nothing about who sent it. HMAC mixes a shared secret key into the hash so only someone holding that key can produce a valid signature, which is what HMAC does at its core: authenticating the sender and protecting the payload from tampering at the same time. Next time you need to verify a webhook or sign an API request, run it through the HMAC Generator above and confirm your signature matches before you trust the payload.

What is HMAC used for beyond webhooks?

A clear way to ask what is HMAC used for is to look at who needs trust. The post above shows one answer, and there are several more. What is HMAC used for in every case? The pattern is always the same: two sides share a secret and need proof that a message is theirs.

What is HMAC used for in real systems?

Here is a map. Read it as an answer to what is HMAC used for in five common places.

Notice what is HMAC used for in each row. The job never changes: prove the sender knows the secret.

AWS signed requests, HS256 tokens and the codes in an authenticator app all rest on the same primitive. That is the short version of what is HMAC used for across the industry.

What is HMAC used for when you stop replay attacks?

A valid signature proves who sent a message. It does not prove when. An attacker can record a genuine request and send it again. So many providers sign a timestamp together with the body. Your server checks the signature and then rejects anything older than a short window, often five minutes. Add a unique request id if you need exact once delivery. So what is HMAC used for here? Binding a message to a moment.

How long is the output when you ask what is HMAC used for?

The length depends on the hash, not on the message or the key. HMAC SHA256 always gives 32 bytes, shown as 64 hex characters. HMAC SHA1 gives 20 bytes, or 40 hex characters. A one byte message and a one gigabyte message produce the same length. Knowing this helps when you store signatures. What is HMAC used for in a database column? Audit trails, and you can size the field once.

Which mistakes break what is HMAC used for in your design?

• Signing a parsed object instead of the raw body. Re serialising changes the bytes, so what is HMAC used for if the signature always fails?
• Using a short or guessable secret. A weak key defeats the point however strong the hash.
• Comparing signatures with a plain equals check. What is HMAC used for if the compare leaks timing? Very little, so use a constant time function.
• Putting the secret in client side code. Anyone can read it, so what is HMAC used for there? Nothing, the signature proves no one.
• Using the same secret for every customer or environment. Rotate keys, because what is HMAC used for without a fresh secret after a leak?

Quick answers: what is HMAC used for by role?

Different readers ask what is HMAC used for with different goals in mind.

• Backend developer: what is HMAC used for in my API? Verifying that each request came from a client holding the key.
• Payments engineer: what is HMAC used for with provider events? Rejecting forged webhook calls before they touch your ledger.
• Mobile developer: what is HMAC used for in an app? Signing requests, though the key must live on a server, never in the app.
• Security reviewer: what is HMAC used for in tokens? Letting a server trust its own HS256 tokens without a database lookup.
• Student: what is HMAC used for in class? A clean example of a keyed hash that a plain hash cannot replace.

Want to see it in action? Paste a message and a key into our HMAC generator and watch the signature change when you edit one character. For the bigger picture, read how hashing differs from encryption. Both help answer what is HMAC used for in plain terms. If you remember one line, remember this: what is HMAC used for is proving a message came from a key holder.

FAQ: What Is HMAC Used For?