HMAC Generator

HMAC generator

This is an HMAC generator: it mixes a secret key with a hash so the tag proves integrity and authenticity. HMAC (RFC 2104) mixes a secret key with a hash so the tag proves integrity and authenticity. Identifiers such as HMAC, HMAC-SHA256, SHA-1, SHA-384, SHA-512, MD5, SHA-3, JWT, HS256, UTF-8, Hex, Base64 and Web Crypto stay untranslated. Show Example uses message The quick brown fox jumps over the lazy dog and key key. HMAC-SHA256 hex is f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8; Base64 is 97yD9DBThCSxMpjmqm+xQ+9NWaFJRhdZl0edvC0aPNg=. HMAC-SHA1 of the same pair is de7c9b85b8b78aa6bc8a7a36f70a90701c9db4d9. Chip message / secret-key is HMAC-SHA256 287a3bd8a4fc7731a94c722079055323644d8798bd291bf9878abc9b8fd4b1d0.

How to use

1. Paste the message or drop a file (max 10 MB). Enter the secret key. An empty key is rejected.
2. Key encoding is UTF-8 text, Hex or Base64. Message Character Encoding matches the Base64 tool (UTF-8, GBK, Big5, Shift_JIS, …).
3. Pick MD5, SHA-1, SHA-224, SHA-256 (default), SHA-384, SHA-512 or SHA-3. Hex case is lower or upper. Copy Result uses the Output format; the two panes always show Hex and Base64.
4. Verify accepts hex or Base64. Cards show algorithm, output bits (256 for HMAC-SHA256), key bytes and time.
5. Nothing is uploaded. SHA-384 and SHA-512 use Web Crypto and need https or localhost.

Algorithms and sizes

HMAC-SHA256 (256 bits) is the usual choice for APIs, webhooks and JWT HS256. HMAC-SHA1 (160 bits) still appears in TOTP and older OAuth; prefer SHA-256 for new work. HMAC-SHA384 / HMAC-SHA512 are 384 and 512 bits. HMAC-MD5 is legacy. SHA-3 variants are available here as well. A plain hash is not HMAC: anyone can compute SHA-256; only holders of the key can compute HMAC-SHA256.

Code (same as Show Example)

Node.js: crypto.createHmac('sha256', 'key').update('The quick brown fox jumps over the lazy dog').digest('hex') → f7bc83f430538424b13298e6aa6fb143ef4d59a14946175997479dbc2d1a3cd8.

Python: hmac.new(b'key', b'The quick brown fox jumps over the lazy dog', hashlib.sha256).hexdigest().

PHP: hash_hmac('sha256', 'The quick brown fox jumps over the lazy dog', 'key'). The chip message / secret-key matches hash_hmac('sha256', 'message', 'secret-key') → 287a3bd8a4fc7731a94c722079055323644d8798bd291bf9878abc9b8fd4b1d0.

What the output means

HMAC does not encrypt and does not hide the message. Hex is 2 characters per byte (64 hex digits for SHA-256). Base64 is the same bytes. Compare signatures with a fixed-time check in production; this page uses a simple equality check for convenience.

Frequently asked questions

• Hash vs HMAC? A hash only checks integrity. HMAC also authenticates the sender who holds the key.
• JWT? HS256 / HS384 / HS512 are HMAC over the JWT header and payload. See JWT Decoder.
• Is HMAC-SHA1 safe? HMAC-SHA1 is still used, but HMAC-SHA256 is the default for new APIs.
• Same as the Hash tool? The Hash tool HMAC field allows an empty key (then it is a plain hash). This page requires a key, shows Hex and Base64 together, and accepts files.

Related tools

Plain digests: MD5 & SHA Hash. Tokens: JWT Decoder. Checksums: CRC32.