HMAC Generator

Generate a keyed HMAC for a message using HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. Enter the message and secret key, select an algorithm, and calculate the result as hexadecimal or Base64.

Calculations use the Web Crypto API in your browser. The key is interpreted as UTF-8 text.

What is HMAC?

HMAC (Hash-based Message Authentication Code) is a cryptographic construction that combines a secret key with a hash function to produce a message authentication code. Anyone who knows the same secret key can calculate or verify the HMAC for a message.

HMAC helps protect message integrity and authenticity. If the key remains secret, a valid HMAC provides evidence that the message was not modified and was authenticated by someone holding that key. HMAC does not encrypt the message or hide its contents.

HMAC is specified in RFC 2104 and FIPS 198-1. This tool supports the following algorithms:

Algorithm Output size Hex characters
HMAC-SHA1 160 bits (20 bytes) 40
HMAC-SHA256 256 bits (32 bytes) 64
HMAC-SHA384 384 bits (48 bytes) 96
HMAC-SHA512 512 bits (64 bytes) 128

HMAC-SHA256 is the default and a suitable choice for most new applications. HMAC-SHA1 may be needed when interoperating with older systems; collision weaknesses in plain SHA-1 do not directly translate into the same attacks against HMAC-SHA1.

How does HMAC work?

HMAC uses a hash function twice with an inner and outer padded version of the secret key. In simplified notation:

HMAC(K, m) = H((K' XOR opad) || H((K' XOR ipad) || m))

Here, K is the secret key, m is the message, H is the selected hash function, and K' is the key processed to the hash function's block size. The inner and outer pads are predefined byte sequences. This design avoids the length-extension problem of simply hashing a secret key followed by a message.

Unlike a plain SHA-256 hash, a matching HMAC for a new message cannot generally be forged without the shared secret key.

Where is HMAC used?

  • API requests and webhooks: Authenticating messages exchanged between services.
  • Signed tokens: JWT algorithms such as HS256, HS384, and HS512 use HMAC.
  • One-time passwords: HOTP and many TOTP implementations use HMAC.
  • Key derivation: HKDF uses HMAC as a cryptographic building block.
  • Network protocols: HMAC is used in certain TLS, IPsec, and SSH constructions.

How to use the HMAC generator

  1. Enter the message in the Message field.
  2. Enter the shared secret in Secret key.
  3. Choose HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.
  4. Choose Hexadecimal (default) or Base64 output.
  5. Select Calculate HMAC and use the copy icon next to the result.

For example, HMAC-SHA256 with the key Jefe and message what do ya want for nothing? produces:

5bdcc146bf60754e6a042426089575c75a003f089d2739839dec58b964ec3843

The calculator interprets both the secret key and the message as UTF-8 text. It does not interpret a hexadecimal-looking key as binary hexadecimal bytes. If another implementation expects a raw binary key, its result may differ from this text-based calculator.

Security considerations

HMAC security depends on the secret key. For production systems, generate keys using a cryptographically secure random source, store them securely, and never expose them in client-side code. A random 32-byte key is a sound choice for HMAC-SHA256; encoding such a key as visible characters is different from using the raw bytes as the key.

This calculator performs the computation locally in the browser with the Web Crypto API; the component does not send the message or key to a hashing server. However, website scripts, browser extensions, and compromised devices can still expose sensitive input. Avoid entering live production secrets into public websites. Prefer a trusted local utility or application-side cryptographic library for production work.

To verify HMACs in an application, compare the received and expected values using a constant-time comparison. HMAC is not a password-storage algorithm: use Argon2id, scrypt, or bcrypt to store passwords.

Frequently asked questions

What is the difference between HMAC and SHA-256?

SHA-256 is an unkeyed cryptographic hash that anyone can calculate. HMAC-SHA256 combines SHA-256 with a secret key so the result can authenticate a message as well as detect modification.

Can HMAC be decrypted or reversed?

No. HMAC is not encryption and has no decryption operation. Knowing the HMAC does not reveal the original message or secret key. However, predictable messages can still be guessed if the key is known.

Is HMAC-SHA1 still secure?

HMAC-SHA1 remains suitable for many legacy authentication uses despite collision attacks against plain SHA-1. Prefer HMAC-SHA256 for new designs.

Why does my HMAC differ from another tool?

Check the message, secret key, chosen hash algorithm, input encoding, and whether the key was interpreted as text or binary. Extra spaces and line breaks change the output. Hexadecimal and Base64 can represent the same HMAC bytes in different formats.

Does the calculator upload my secret key?

No. The HMAC operation runs locally through the browser's Web Crypto API. Nevertheless, third-party website scripts and browser extensions can be a risk; do not paste production secrets into online calculators.

Last updated:

© 2008–2026 XORBIN.COM. All rights reserved.