HMAC Generator

About HMAC generator

HMAC combines a secret key with a hash function to produce a tag that proves a message came from someone holding the key and was not altered. This tool computes HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384 or HMAC-SHA-512 of a message and shows the result in hex or Base64, which is what you need when building or debugging signed webhooks and API request signatures.

How to use it

1. Choose an algorithm under Hash algorithm. HMAC-SHA-256 is preselected.
2. Type the text to sign into the Message box.
3. Enter the Secret key, and turn on the Key is hex-encoded switch if your key is given as hex digits rather than plain text.
4. Select Generate HMAC, then flip between Hex and Base64 and use Copy to take the value.

The well-known HMAC-SHA-256 test pair

Algorithm HMAC-SHA-256, secret key: key, message: The quick brown fox jumps over the lazy dog

Hex f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8, Base64 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg= (32 bytes, 256 bits)

When to use it

• Reproducing a webhook signature locally to find out why your server rejects a delivery.
• Building the signature string for an API that authenticates requests with an HMAC of the body.
• Checking a library's output against a second implementation while writing signing code.
• Working out whether a mismatch comes from key encoding, the message bytes or the algorithm.

Questions about HMAC generator

How is HMAC different from hashing the message with the key attached?

Simply appending a key to a message before an ordinary hash is vulnerable to length-extension attacks with SHA-2. HMAC runs the hash twice with padded inner and outer keys, which avoids that weakness.

Is HMAC-SHA-1 still acceptable?

Yes, for now. HMAC does not rely on collision resistance the way plain SHA-1 signatures do, so known SHA-1 collisions do not break it. It is marked legacy, and new systems should choose SHA-256 or above.

When should the hex switch be on?

Turn it on when your key is written as pairs of hexadecimal digits, for example 0b0b0b0b. Leaving it off treats every character as UTF-8 text, so the same string produces a completely different tag.

What happens with a very long key?

HMAC hashes any key longer than the hash's block size, 64 bytes for SHA-1 and SHA-256 and 128 bytes for SHA-384 and SHA-512, then uses the result. Very long keys add no strength beyond the hash's output size.

Why does the tool refuse an empty key?

An HMAC with no secret authenticates nothing, since anyone could compute it, so the page shows an error asking for a key. An empty message, by contrast, is allowed.

Related tools

• JWT verifierVerify a JWT's HMAC signature against a secret and validate its time claims.
• File hash checkerHash a file with SHA-1, SHA-256, SHA-384 or SHA-512 and compare it against a published checksum.
• MD5 GeneratorGenerate an MD5 hash from text
• SHA GeneratorGenerate SHA-1, SHA-256, SHA-384, and SHA-512 hashes
• Bcrypt GeneratorGenerate a bcrypt hash from text
• JWT DecoderDecode and inspect JWT tokens — view header, payload claims, expiry, and signature.